Security News > 2021 > October > Misconfigured Apache Airflow servers leak thousands of credentials
While investigating a misconfiguration flaw in Apache Airflow, researchers discovered many exposed instances over the web leaking sensitive information, including credentials, from well-known tech companies.
Apache Airflow is a popular open-source workflow management platform for organizing and managing tasks.
This week, researchers Nicole Fishbein and Ryan Robinson from security firm Intezer have disclosed details on how they identified misconfiguration errors across Apache Airflow servers run by major tech companies.
In various scenarios that researchers have analyzed, the most common reason for credential leak seen on Airflow servers was insecure coding practices.
"The configuration file is created when Airflow is first started. It contains Airflow's configuration and it is able to be changed," state the researchers.
Intezer states the vast majority of these flaws were identified in servers running Airflow v1.