PT-2026-33593 · Apache · Apache Airflow

Jason · Published 2026-04-18 · Updated 2026-04-19 · CVE-2026-30912

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description SQL errors cause the API to expose exception and stack trace information, even when the api/expose stack traces setting is disabled. This behavior can leak sensitive information to a potential attacker.

Recommendations Upgrade to version 3.2.0.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2026-30912

Affected Products

Apache Airflow

References · 6

• https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30912 · Security Note
• https://github.com/apache/airflow/pull/63028 · Patch
• https://twitter.com/CVEnew/status/2045467317283250242 · Twitter Post
• https://twitter.com/oss_security/status/2045900381931086041 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/17/5 · Note