Apache Airflow Connections API exposes apprise config extra in cleartext (CVE-2026-107474)
The apprise provider's config extra is returned unmasked in the Connections API allowing credential exposure in versions before 3.4.0.
50
CVE-2026-107474
Cleartext apprise config in Apache Airflow connections API
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext. Apache Airflow 3 treats connection credentials as write-only. This affects users before the 3.4.0 release.
What to do: Upgrade to Apache Airflow 3.4.0 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | — | 3.4.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
- Weakness
- CWE-522