[<prev] [next>] [day] [month] [year] [list]
Message-ID: <8dc87e1d-580e-c0d1-664c-79e7aca24b2c@apache.org>
Date: Fri, 17 Apr 2026 10:15:40 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-30912: Apache Airflow: Exposing stack trace in case of
constraint error
Severity: low
Affected versions:
- Apache Airflow (apache-airflow) before 3.2.0
Description:
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
Credit:
Masamune - Unit515 OPSWAT (finder)
Jason(Zhe-You) Liu (remediation developer)
References:
https://github.com/apache/airflow/pull/63028
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-30912
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
