PT-2026-39579 · Apache Airflow · Apache Airflow Providers Opensearch

Aleksandr Sozinov + 2 · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-43826

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-opensearch versions prior to 1.9.1

Description The OpenSearch logging provider writes the full host URL into task logs when configured with a host URL that embeds credentials. This allows any user with task-log read permissions to harvest the backend credentials.

Recommendations Upgrade to version 1.9.1 or later. Configure backend credentials via a secret backend instead of embedding them in the host URL.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-43826

GHSA-XCCP-97WP-3GJG

PYSEC-2026-23

Affected Products

Apache Airflow Providers Opensearch

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43826.json · Exploit
• https://github.com/apache/airflow/pull/65509 · Patch
• https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43826 · Security Note
• https://osv.dev/vulnerability/CVE-2026-43826 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xccp-97wp-3gjg · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43826 · Security Note
• https://ubuntu.com/security/CVE-2026-43826 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43826 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/6a6b6ff409fb48c28bd63482828632a3c5a5bb93 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-opensearch/PYSEC-2026-23.yaml · Note
• https://pypi.python.org · Note
• http://openwall.com/lists/oss-security/2026/05/10/2 · Note