Sensitive Configuration Exposure in Apache Airflow by Apache

CVE-2026-107474

What is CVE-2026-107474?

The Apache Airflow connections API exposes a significant security weakness by failing to adequately mask the config connection extra for the apprise provider. This oversight can allow users with permission to read connections to access sensitive notification-service credentials in cleartext. Although version 3 of Airflow treats connection credentials as write-only, earlier versions do not enforce this protection, potentially compromising sensitive data. Users are strongly encouraged to upgrade to apache-airflow 3.4.0 or later to mitigate this issue.

References