PUBLISHED
2026-04-18 07:16
MODIFIED
2026-04-18 07:16
EPSS (Prob. Exploit)
0.76%
Top 45.3%
> DESCRIPTION
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-668: Exposure of Resource to Wrong Sphere - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
> GITHUB SECURITY ADVISORY
GHSA-w7cf-2pmc-5m4c
MODERATE
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
AFFECTED PACKAGES:
PIP / apache-airflow-core
< 3.2.0
Fixed in: 3.2.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Exposing stack trace in case of constraint error
AFFECTED PACKAGES:
Unknown / Unknown
8218 versions affected
ALIASES:
BIT-airflow-2026-30912, GHSA-w7cf-2pmc-5m4c, PYSEC-2026-18, PYSEC-2026-2361
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/04/2026 07:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-668: Exposure of Resource to Wrong Sphere - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Total des modifications: 1
Dernière mise à jour: 6 months ago