[<prev] [next>] [day] [month] [year] [list]
Message-ID: <f2c0fa1d-d4ec-2bf9-f73d-67c19f54fb56@apache.org>
Date: Sun, 10 May 2026 19:34:26 +0000
From: Shahar Epstein <shahar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-41018: Apache Airflow Providers Elasticsearch:
Elasticsearch task-log handlers leak credentials embedded in the host URL
Severity: low
Affected versions:
- Apache Airflow Providers Elasticsearch (apache-airflow-providers-elasticsearch) before 6.5.3
Description:
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example ` https://user:password@...ver.example.com:9200` ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. The two providers are forks of the same codebase and shared the same bug. Users are advised to upgrade to a fixed version of `apache-airflow-providers-elasticsearch` and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch]` URL.
Credit:
Aleksandr Sozinov (finder)
Jarek Potiuk (remediation developer)
References:
https://github.com/apache/airflow/pull/65349
https://github.com/apache/airflow/pull/65509
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-41018
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
