{"id":"CVE-2024-25141","aliases":["GHSA-x5pm-h33q-cjrw","PYSEC-2026-278"],"title":"Improper Certificate Validation in apache airflow mongo hook","summary":"Improper Certificate Validation in apache airflow mongo hook","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","vendor":"apache-airflow-providers-mongo","product":"apache-airflow-providers-mongo","ecosystem":"pip","affected":["apache-airflow-providers-mongo < 4.0.0"],"patched":["apache-airflow-providers-mongo 4.0.0"],"published":"2024-02-20","updated":"2026-10-26","sourceUpdated":"2026-10-26T21:30:05.353696502Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-x5pm-h33q-cjrw","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25141"},{"url":"https://github.com/apache/airflow/pull/37214"},{"url":"https://github.com/apache/airflow"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-mongo/PYSEC-2026-278.yaml"},{"url":"https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm"},{"url":"https://pypi.org/project/apache-airflow-providers-mongo"},{"url":"http://www.openwall.com/lists/oss-security/2024/02/20/5"},{"url":"https://github.com/advisories/GHSA-x5pm-h33q-cjrw"}],"tags":["osv","pip","ghsa"],"epss":0.00625,"epssPercentile":0.4975,"cwe":["CWE-295"],"ingestedAt":"2026-10-27T16:11:58.775Z","slug":"CVE-2024-25141","body":"## Overview\n\nWhen ssl was enabled for Mongo Hook, default settings included \"allow_insecure\" which caused that certificates were not validated. This was unexpected and undocumented.\nUsers are recommended to upgrade to version 4.0.0, which fixes this issue.\n\n## Affected packages\n\n- `apache-airflow-providers-mongo < 4.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-airflow-providers-mongo 4.0.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}