CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
Apache Software Foundation · Apache Airflow
Vendor fix available · Affected: Apache Software Foundation Apache Airflow · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- Apache Airflow and Storm updates fix 20 security flawsSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.