Executive brief
Apache Airflow, a platform used to schedule and monitor workflows, contains a vulnerability where sensitive database information may be leaked. When a database error occurs, the system may display detailed technical error messages (stack traces) through its API, even if administrators have explicitly disabled this feature. This could allow an attacker to gain insights into the internal database structure or query logic, potentially aiding in further attacks.
Technical details
An information exposure vulnerability exists in Apache Airflow's REST API due to improper handling of SQL exceptions. Specifically, when a database constraint failure or SQL error occurs, the resulting exception and stack trace are returned in the API response regardless of the 'api/expose_stack_traces' configuration setting. This is classified as CWE-668 (Exposure of Resource to Wrong Sphere). A remote, unauthenticated attacker can trigger these errors to obtain sensitive information about the database schema and internal SQL queries. The issue is resolved in version 3.2.0 by updating the exception handler to respect the configuration flag.
Affected products
- Apache Airflow < 3.2.0
Timeline
- 2026-03-10: patched: Pull request merged into main branch
- 2026-04-17: disclosed: Mailing list announcement
- 2026-04-18: advisory: GitHub and NVD advisories published