PT-2026-39578 · Apache Airflow · Apache Airflow Providers Elasticsearch

Aleksandr Sozinov + 1 · Published 2026-05-11 · Updated 2026-06-08 · CVE-2026-41018

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-elasticsearch versions prior to 6.5.3

Description The Elasticsearch logging provider writes the full host URL into task logs when configured with a host URL that embeds credentials. This allows any user with task-log read permissions to harvest the backend credentials.

Recommendations Upgrade to version 6.5.3 or later. Configure backend credentials via a secret backend instead of embedding them in the host URL.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CLEANSTART-2026-AZ09261

CVE-2026-41018

GHSA-G3JR-4JRM-JVQV

PYSEC-2026-22

Affected Products

Apache Airflow Providers Elasticsearch

References · 162

• https://github.com/apache/airflow/pull/65349 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-12797 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46136 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-22 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-AZ09261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710 · Security Note
• https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21860 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44681 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41016 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34517 · Security Note