Open-source package vulnerability · PyPI

CVE-2024-25141: Improper Certificate Validation in apache airflow mongo hook

criticalCVSS 3.1 9.1GHSA-x5pm-h33q-cjrw

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

Published Feb 20, 2024 · Updated Mar 18, 2026

Affected packages

apache-airflow-providers-mongo

Ecosystem: PyPI
Affected: < 4.0.0
Fixed in: 4.0.0
Check: pip show apache-airflow-providers-mongo

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology