Exposure of Credentials in OpenSearch Logging Provider by Apache
CVE-2026-43826

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow Providers Opensearch
Vendor
CVE Published:
11 May 2026

What is CVE-2026-43826?

The OpenSearch logging provider has a critical security flaw where credentials embedded in the host URL are recorded in task logs. This vulnerability allows any user with the appropriate permissions to access sensitive backend credentials easily. To mitigate this risk, it is recommended that users upgrade to version 1.9.1 or later of the apache-airflow-providers-opensearch and utilize a secret backend for storing credentials instead of incorporating them within the host URL.

Affected Version(s)

Apache Airflow Providers OpenSearch 0 < 1.9.1

References

https://github.com/apache/airflow/pull/65509
patch
https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcos...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aleksandr Sozinov
Owen-CH-Leung
Jarek Potiuk
.