PT-2026-33593 · Apache · Apache Airflow

Jason · Published 2026-04-18 · Updated 2026-04-21 · CVE-2026-30912

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description SQL errors cause the API to expose exception and stack trace information, even when the api/expose stack traces setting is disabled. This behavior can leak sensitive information to a potential attacker.

Recommendations Upgrade to version 3.2.0.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BIT-AIRFLOW-2026-30912

CVE-2026-30912

GHSA-W7CF-2PMC-5M4C

PYSEC-2026-18

Affected Products

Apache Airflow

References · 11

• https://github.com/apache/airflow/pull/63028 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-18 · Vendor Advisory
• https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-30912 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7cf-2pmc-5m4c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30912 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml · Note
• http://openwall.com/lists/oss-security/2026/04/17/5 · Note
• https://twitter.com/oss_security/status/2045900381931086041 · Twitter Post
• https://twitter.com/CVEnew/status/2045467317283250242 · Twitter Post