CVE-2026-107474
Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
| CWE | CWE-522 |
| Vendor | apache software foundation |
| Product | apache airflow |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache airflow
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Airflow
2.4.0 < 3.0.0
Apache Software Foundation / Apache Airflow
0 < 3.4.0
References
Credits
JelyFishhhhhh Jarek Potiuk