Exposure of Credentials in OpenSearch Logging Provider by Apache

CVE-2026-43826

What is CVE-2026-43826?

The OpenSearch logging provider has a critical security flaw where credentials embedded in the host URL are recorded in task logs. This vulnerability allows any user with the appropriate permissions to access sensitive backend credentials easily. To mitigate this risk, it is recommended that users upgrade to version 1.9.1 or later of the apache-airflow-providers-opensearch and utilize a secret backend for storing credentials instead of incorporating them within the host URL.

References