Is CVE-2026-30912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30912 being exploited in the wild.

How severe is CVE-2026-30912?

High severity, with a CVSS score of 7.5, published 18 April 2026.

Which products and versions are affected?

Apache Airflow < 3.2.0; apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0; apache-airflow-core (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

Is there a fix for CVE-2026-30912?

Yes. apache-airflow (PyPI): upgrade to 3.2.0 or later; apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30912 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-30912?

Check whether you run Apache Airflow, apache-airflow (PyPI) or apache-airflow-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30912: Apache Airflow information exposure in API SQL stack traces

Q: Which products and versions are affected?

Apache Airflow < 3.2.0; apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0; apache-airflow-core (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

Q: Is there a fix for CVE-2026-30912?

Yes. apache-airflow (PyPI): upgrade to 3.2.0 or later; apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30912 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-30912?

Check whether you run Apache Airflow, apache-airflow (PyPI) or apache-airflow-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30912 · Severity: high · CVSS 7.5 · Published 2026-04-18

Apache Airflow, a platform used to schedule and monitor workflows, contains a vulnerability where sensitive database information may be leaked. When a database error occurs, the system may display detailed technical error messages (stack traces) through its API, even if administrators have explicitly disabled this feature. This could allow an attacker to gain insights into the internal database structure or query logic, potentially aiding in further attacks.

Technologies: Apache Airflow, apache-airflow (PyPI), apache-airflow-core (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2026-30912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30912 being exploited in the wild.
How severe is CVE-2026-30912?: High severity, with a CVSS score of 7.5, published 18 April 2026.
Which products and versions are affected?: Apache Airflow < 3.2.0; apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0; apache-airflow-core (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2026-30912?: Yes. apache-airflow (PyPI): upgrade to 3.2.0 or later; apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30912 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-30912?: Check whether you run Apache Airflow, apache-airflow (PyPI) or apache-airflow-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 3.2.0 or later
```
pip install "apache-airflow>=3.2.0"
```
apache-airflow-core (PyPI): upgrade to 3.2.0 or later
```
pip install "apache-airflow-core>=3.2.0"
```

Technical details

An information exposure vulnerability exists in Apache Airflow's REST API due to improper handling of SQL exceptions. Specifically, when a database constraint failure or SQL error occurs, the resulting exception and stack trace are returned in the API response regardless of the 'api/expose_stack_traces' configuration setting. This is classified as CWE-668 (Exposure of Resource to Wrong Sphere). A remote, unauthenticated attacker can trigger these errors to obtain sensitive information about the database schema and internal SQL queries. The issue is resolved in version 3.2.0 by updating the exception handler to respect the configuration flag.

Affected products

Apache Airflow < 3.2.0

Identifiers

CVE-2026-30912
GHSA-w7cf-2pmc-5m4c
PYSEC-2026-18
PYSEC-2026-2361

Timeline

2026-03-10: patched: Pull request merged into main branch
2026-04-17: disclosed: Mailing list announcement
2026-04-18: advisory: GitHub and NVD advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.