BIT-airflow-2026-30912

vendorUSosv

Apache Airflow: Exposing stack trace in case of constraint error

view advisory published 2026-04-21Licence: per source

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-30912US	—	0.45% (39th)	—	2026-04-18
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/04/17/5ADVISORY
https://github.com/apache/airflow/pull/63028REPORT
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-30912WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan