Sensitive Data Exposure in Apache Airflow API Endpoint

CVE-2026-45192

What is CVE-2026-45192?

A vulnerability in the Apache Airflow REST API's GET /api/v2/connections/{connection_id} endpoint enables unauthorized users with Connection-read permission to access sensitive information stored in a Connection's extra JSON field. The issue arises when field names that are not included in the redaction allowlist (DEFAULT_SENSITIVE_FIELDS) are returned in plaintext, potentially exposing secrets such as official Slack-provider credentials. This vulnerability affects installations that store credentials within these Connection extra blobs and allow multiple users read access. Users are encouraged to update to Apache Airflow version 3.2.2 or later. As a best practice, it is advised to store sensitive credential information in a secret-backend instead of inlined into the Connection's extra field.

References