{"id":"CVE-2024-25141","kind":"vulnerability","aliases":["CVE-2024-25141","GHSA-x5pm-h33q-cjrw"],"related":[],"title":"Improper Certificate Validation in apache airflow mongo hook","description":"When ssl was enabled for Mongo Hook, default settings included \"allow_insecure\" which caused that certificates were not validated. This was unexpected and undocumented.\nUsers are recommended to upgrade to version 4.0.0, which fixes this issue.","summary":"When SSL is enabled in the Airflow MongoDB hook, the default settings allow insecure connections, so server certificates are not validated. An attacker positioned on the network path can impersonate the MongoDB server and intercept or alter the data and credentials passed over the connection.","severity":"critical","cvss":9.1,"epss":0.00625,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow-providers-mongo","fixed":["4.0.0"],"affected":"< 4.0.0","ecosystem":"pypi"},{"name":"apache apache-airflow-providers-mongo","fixed":["4.0.0"],"affected":">= 1.0.0, < 4.0.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["airflow","cwe-295","mongodb","package","python","self-hosted"],"not_affected_if":["managed-hosting","no-mongo-provider","non-tls-connections"],"how_to_check":"- Run `pip show apache-airflow-providers-mongo` and check whether the version is below `4.0.0`\n- Look for Mongo connections with SSL enabled and no explicit `allow_insecure` or `tlsAllowInvalidCertificates` setting in the Airflow connection configuration","fix":"- Upgrade `apache-airflow-providers-mongo` to `4.0.0` or later\n- Explicitly set certificate validation on Mongo connections rather than relying on the default","status":"open","published_at":"2024-02-20T21:15:08+00:00","first_seen_at":"2026-10-26T21:11:44+00:00","triaged_at":"2026-10-26T21:12:44+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T21:12:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `apache-airflow-providers-mongo` to `4.0.0` or later\n- Explicitly set certificate validation on Mongo connections rather than relying on the default","reach":"network","title":"Apache Airflow Mongo provider skips TLS certificate checks by default","impact":"high","summary":"When SSL is enabled in the Airflow MongoDB hook, the default settings allow insecure connections, so server certificates are not validated. An attacker positioned on the network path can impersonate the MongoDB server and intercept or alter the data and credentials passed over the connection.","category":"package","nicknames":[],"who_cares":["airflow","python","mongodb","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"man-in-the-middle can read and alter MongoDB traffic and credentials","analyst_note":"","how_to_check":"- Run `pip show apache-airflow-providers-mongo` and check whether the version is below `4.0.0`\n- Look for Mongo connections with SSL enabled and no explicit `allow_insecure` or `tlsAllowInvalidCertificates` setting in the Airflow connection configuration","needs_analyst":false,"not_affected_if":["no-mongo-provider","non-tls-connections","managed-hosting"],"who_is_affected":"Teams running Apache Airflow with the MongoDB provider package below 4.0.0 that connect to MongoDB over SSL/TLS. The exposure depends on an attacker being able to sit on the network path between Airflow and the MongoDB server, so connections over trusted private networks carry lower practical risk. Teams not using the MongoDB provider can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000641,"input_tokens":3350,"output_tokens":611,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':10A,18A '-25141':11A,19A '-295':33B '4.0.0':116C 'airflow':6A,22A,28A,31B,46B 'allow':52B,95C 'alter':76B 'apach':5A 'apache':21A,25A,27A 'apache-airflow-providers-mongo':20A,26A 'attack':62B 'caus':98C 'certif':2A,57B,100C 'cjrw':16A 'connect':54B,84B 'credenti':80B 'cve':9A,17A 'cwe':32B 'data':78B 'default':50B,92C 'enabl':43B,88C 'fix':118C 'ghsa':13A 'ghsa-x5pm-h33q-cjrw':12A 'h33q':15A 'hook':8A,48B,91C 'host':39B 'imperson':69B 'improp':1A 'includ':94C 'insecur':53B,96C 'intercept':74B 'issu':120C 'mongo':7A,24A,30A,90C 'mongodb':34B,47B,71B 'network':66B 'packag':35B 'pass':81B 'path':67B 'posit':63B 'providers':23A,29A 'python':36B 'recommend':111C 'self':38B 'self-host':37B 'server':56B,72B 'set':51B,93C 'ssl':41B,86C 'undocu':108C 'unexpect':106C 'upgrad':113C 'user':109C 'valid':3A,60B,103C 'version':115C 'x5pm':14A","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow with the MongoDB provider package below 4.0.0 that connect to MongoDB over SSL/TLS. The exposure depends on an attacker being able to sit on the network path between Airflow and the MongoDB server, so connections over trusted private networks carry lower practical risk. Teams not using the MongoDB provider can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-02-20T21:15:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-x5pm-h33q-cjrw","url":"https://github.com/advisories/GHSA-x5pm-h33q-cjrw","severity":"critical","published_at":"2024-02-20T21:30:26+00:00","modified_at":"2026-10-26T21:11:14+00:00","first_seen_at":"2026-10-26T21:11:44+00:00","fetched_at":"2026-10-26T21:11:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-25141","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25141","severity":null,"published_at":"2024-02-20T21:15:08+00:00","modified_at":"2026-06-17T07:15:35+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}