Apache Airflow Connections API exposes apprise config extra in cleartext (CVE-2026-107474)
Original title: CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
The apprise provider's config extra is returned unmasked in the Connections API allowing credential exposure in versions before 3.4.0.
The Apache Airflow connections API did not mask the apprise provider's config connection extra. A user with permission to read connections could retrieve notification-service credentials in cleartext. Airflow 3 treats connection credentials as write-only. The vulnerability affects Apache Airflow before 3.4.0. Users are advised to upgrade to apache-airflow 3.4.0 or later.
- Apprise config extra not masked
- Credentials exposed in cleartext
- Affects versions before 3.4.0
- Upgrade to 3.4.0 required
Impact: exposing connection credentials
- 1.Upgrade to Apache Airflow 3.4.0 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107474 | Cleartext apprise config in Apache Airflow connections API | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3. 4. 0 Description: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.