PUBLISHED
2026-05-11 09:16
MODIFIED
2026-05-11 09:16
EPSS (Prob. Exploit)
0.41%
Top 64.5%
> DESCRIPTION
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-532: Insertion of Sensitive Information into Log File - The product writes sensitive information to a log file.
> GITHUB SECURITY ADVISORY
GHSA-g3jr-4jrm-jvqv
MODERATE
Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL
AFFECTED PACKAGES:
PIP / apache-airflow-providers-elasticsearch
< 6.5.3
Fixed in: 6.5.3
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL
AFFECTED PACKAGES:
Unknown / Unknown
6817 versions affected
ALIASES:
GHSA-g3jr-4jrm-jvqv, PYSEC-2026-22
> HISTORIQUE DES MODIFICATIONS
Première apparition
11/05/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/06/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-532: Insertion of Sensitive Information into Log File - The product writes sensitive information to a log file.
Total des modifications: 1
Dernière mise à jour: 5 months ago