PYSEC-2026-18

vendorUSosv

view advisory published 2026-04-18Licence: CC-BY-4.0

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-30912US	—	0.45% (39th)	—	2026-04-18
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/04/17/5ADVISORY
https://github.com/apache/airflow/pull/63028REPORT
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan