Junglewise Threat Intelligence

CVE-2026-30912: Apache Airflow information exposure in API SQL stack traces

CVE-2026-30912 · Severity: medium · CVSS 5.3 · Published 2026-04-18

Technologies: Apache Airflow, apache-airflow-core (PyPI), apache-airflow (PyPI). Vendors: Apache, PyPI.

Executive brief

Apache Airflow, a platform used to schedule and monitor workflows, contains a vulnerability where sensitive database information may be leaked. When a database error occurs, the system may display detailed technical error messages (stack traces) through its API, even if administrators have explicitly disabled this feature. This could allow an attacker to gain insights into the internal database structure or query logic, potentially aiding in further attacks.

Technical details

An information exposure vulnerability exists in Apache Airflow's REST API due to improper handling of SQL exceptions. Specifically, when a database constraint failure or SQL error occurs, the resulting exception and stack trace are returned in the API response regardless of the 'api/expose_stack_traces' configuration setting. This is classified as CWE-668 (Exposure of Resource to Wrong Sphere). A remote, unauthenticated attacker can trigger these errors to obtain sensitive information about the database schema and internal SQL queries. The issue is resolved in version 3.2.0 by updating the exception handler to respect the configuration flag.

Affected products

  • Apache Airflow < 3.2.0

Timeline

  • 2026-03-10: patched: Pull request merged into main branch
  • 2026-04-17: disclosed: Mailing list announcement
  • 2026-04-18: advisory: GitHub and NVD advisories published

References

Related threats