---
id: "CVE-2024-25141"
kind: "vulnerability"
aliases: ["CVE-2024-25141", "GHSA-x5pm-h33q-cjrw"]
title: "Improper Certificate Validation in apache airflow mongo hook"
severity: "critical"
cvss: 9.1
epss: 0.00625
exploited: false
status: "open"
category: "package"
products: [{"name": "apache-airflow-providers-mongo", "fixed": ["4.0.0"], "affected": "< 4.0.0", "ecosystem": "pypi"}, {"name": "apache apache-airflow-providers-mongo", "fixed": ["4.0.0"], "affected": ">= 1.0.0, < 4.0.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["airflow", "cwe-295", "mongodb", "package", "python", "self-hosted"]
not_affected_if: ["managed-hosting", "no-mongo-provider", "non-tls-connections"]
published_at: "2024-02-20T21:15:08+00:00"
first_seen_at: "2026-10-26T21:11:44+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-x5pm-h33q-cjrw", "first_seen_at": "2026-10-26T21:11:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25141", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# Improper Certificate Validation in apache airflow mongo hook

When SSL is enabled in the Airflow MongoDB hook, the default settings allow insecure connections, so server certificates are not validated. An attacker positioned on the network path can impersonate the MongoDB server and intercept or alter the data and credentials passed over the connection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apache-airflow-providers-mongo affected < 4.0.0 fixed 4.0.0
- vendor:apache apache-airflow-providers-mongo affected >= 1.0.0, < 4.0.0 fixed 4.0.0

## How to check

- Run `pip show apache-airflow-providers-mongo` and check whether the version is below `4.0.0`
- Look for Mongo connections with SSL enabled and no explicit `allow_insecure` or `tlsAllowInvalidCertificates` setting in the Airflow connection configuration

## Fix

- Upgrade `apache-airflow-providers-mongo` to `4.0.0` or later
- Explicitly set certificate validation on Mongo connections rather than relying on the default

## Timeline

- 2026-10-26T21:11:44+00:00 ghsa https://github.com/advisories/GHSA-x5pm-h33q-cjrw
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-25141

## From the sources

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented.
Users are recommended to upgrade to version 4.0.0, which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_