PT-2026-45281 · Apache · Apache Airflow

Jarek Potiuk · Published 2026-06-01 · Updated 2026-06-05 · CVE-2026-45192

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description A bug in the GET '/api/v2/connections/{connection id}' REST API endpoint allows an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob. This occurs when secrets are stored under field names not included in the redaction allowlist (DEFAULT SENSITIVE FIELDS), resulting in sensitive data, such as Slack-provider credential field names, being returned in plaintext. This issue affects deployments that store credentials in Connection extra blobs and grant Connection-read access to multiple users.

Recommendations Upgrade to version 3.2.2 or later. Store sensitive credential values in a secret-backend instead of inlining them into the Connection's extra field.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-AIRFLOW-2026-45192

CVE-2026-45192

PYSEC-2026-173

Affected Products

Apache Airflow

References · 7

• https://github.com/apache/airflow/pull/66673 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45192 · Security Note
• https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-173 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-45192 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/06/01/3 · Note
• https://t.me/cveNotify/165423 · Telegram Post