All vulnerabilities
CVE-2024-25141GHSA-x5pm-h33q-cjrwPYSEC-2026-278

apache-airflow-providers-mongo: Improper Certificate Validation in apache airflow mongo hook

Apache Software Foundation apache-airflow-providers-mongopipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.63%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in4.0.0Fixed versionGitHub
Published20 Feb 2024Updated 26 Oct 2026CVE List

What fixes it

  • 4.0.0apache-airflow-providers-mongo, pipGitHub
  • 4.0.0Apache Airflow Mongo ProviderCVE List
  • 4.0.0apache-airflow-providers-mongo, PyPIOSVpip install "apache-airflow-providers-mongo>=4.0.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

Text from GitHub Advisory Database

Affected versions 48

  • apache-airflow-providers-mongo, pip< 4.0.0GitHub
  • Apache Airflow Mongo Provideraffected: 1.0.0 before 4.0.0CVE List
  • apache-airflow-providers-mongo, PyPIfrom first release, fixed in 4.0.0OSV
  • apache-airflow-providers-mongo, PyPI1.0.0OSV
  • apache-airflow-providers-mongo, PyPI1.0.0b1OSV
  • apache-airflow-providers-mongo, PyPI1.0.0b2OSV
  • apache-airflow-providers-mongo, PyPI1.0.0rc1OSV
  • apache-airflow-providers-mongo, PyPI1.0.1OSV
  • apache-airflow-providers-mongo, PyPI1.0.1rc1OSV
  • apache-airflow-providers-mongo, PyPI2.0.0OSV
  • apache-airflow-providers-mongo, PyPI2.0.0rc1OSV
  • apache-airflow-providers-mongo, PyPI2.0.0rc2OSV
  • apache-airflow-providers-mongo, PyPI2.1.0OSV
  • apache-airflow-providers-mongo, PyPI2.1.0rc1OSV
  • apache-airflow-providers-mongo, PyPI2.2.0OSV
  • apache-airflow-providers-mongo, PyPI2.2.0rc1OSV
  • apache-airflow-providers-mongo, PyPI2.3.0OSV
  • apache-airflow-providers-mongo, PyPI2.3.0rc1OSV
  • apache-airflow-providers-mongo, PyPI2.3.1OSV
  • apache-airflow-providers-mongo, PyPI2.3.1rc1OSV
  • apache-airflow-providers-mongo, PyPI2.3.2OSV
  • apache-airflow-providers-mongo, PyPI2.3.2rc1OSV
  • apache-airflow-providers-mongo, PyPI2.3.3OSV
  • apache-airflow-providers-mongo, PyPI2.3.3rc1OSV
  • apache-airflow-providers-mongo, PyPI3.0.0OSV
  • apache-airflow-providers-mongo, PyPI3.0.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.0.0rc2OSV
  • apache-airflow-providers-mongo, PyPI3.1.0OSV
  • apache-airflow-providers-mongo, PyPI3.1.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.1.1OSV
  • apache-airflow-providers-mongo, PyPI3.1.1rc1OSV
  • apache-airflow-providers-mongo, PyPI3.2.0OSV
  • apache-airflow-providers-mongo, PyPI3.2.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.2.0rc2OSV
  • apache-airflow-providers-mongo, PyPI3.2.1OSV
  • apache-airflow-providers-mongo, PyPI3.2.1rc1OSV
  • apache-airflow-providers-mongo, PyPI3.2.2OSV
  • apache-airflow-providers-mongo, PyPI3.2.2rc1OSV
  • apache-airflow-providers-mongo, PyPI3.3.0OSV
  • apache-airflow-providers-mongo, PyPI3.3.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.4.0OSV
  • apache-airflow-providers-mongo, PyPI3.4.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.5.0OSV
  • apache-airflow-providers-mongo, PyPI3.5.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.6.0OSV
  • apache-airflow-providers-mongo, PyPI3.6.0rc1OSV
  • apache-airflow-providers-mongo, PyPI3.6.0rc2OSV
  • apache-airflow-providers-mongo, PyPI4.0.0rc1OSV

References 6