# CVE-2026-30912: Apache Airflow information exposure in API SQL stack traces

Source: https://junglewise.ai/threats/cve-2026-30912-apache-airflow-information-exposure-in-api-sql-stack-traces  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-18. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-30912 · Severity: high · CVSS 7.5 · Published 2026-04-18

Apache Airflow, a platform used to schedule and monitor workflows, contains a vulnerability where sensitive database information may be leaked. When a database error occurs, the system may display detailed technical error messages (stack traces) through its API, even if administrators have explicitly disabled this feature. This could allow an attacker to gain insights into the internal database structure or query logic, potentially aiding in further attacks.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow), [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow), [apache-airflow-core (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow-core). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-30912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30912 being exploited in the wild.

**How severe is CVE-2026-30912?** High severity, with a CVSS score of 7.5, published 18 April 2026.

**Which products and versions are affected?** Apache Airflow < 3.2.0; apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0; apache-airflow-core (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

**Is there a fix for CVE-2026-30912?** Yes. apache-airflow (PyPI): upgrade to 3.2.0 or later; apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30912 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30912?** Check whether you run Apache Airflow, apache-airflow (PyPI) or apache-airflow-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow (PyPI): upgrade to 3.2.0 or later

  ```sh
  pip install "apache-airflow>=3.2.0"
  ```

- apache-airflow-core (PyPI): upgrade to 3.2.0 or later

  ```sh
  pip install "apache-airflow-core>=3.2.0"
  ```


## Technical details

An information exposure vulnerability exists in Apache Airflow's REST API due to improper handling of SQL exceptions. Specifically, when a database constraint failure or SQL error occurs, the resulting exception and stack trace are returned in the API response regardless of the 'api/expose_stack_traces' configuration setting. This is classified as CWE-668 (Exposure of Resource to Wrong Sphere). A remote, unauthenticated attacker can trigger these errors to obtain sensitive information about the database schema and internal SQL queries. The issue is resolved in version 3.2.0 by updating the exception handler to respect the configuration flag.

## Affected products

- Apache Airflow < 3.2.0

## Identifiers

- CVE-2026-30912
- GHSA-w7cf-2pmc-5m4c
- PYSEC-2026-18
- PYSEC-2026-2361

## Timeline

- 2026-03-10: patched: Pull request merged into main branch
- 2026-04-17: disclosed: Mailing list announcement
- 2026-04-18: advisory: GitHub and NVD advisories published

## References

- [https://github.com/apache/airflow/pull/63028](https://github.com/apache/airflow/pull/63028)
- [https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9](https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9)
- [http://www.openwall.com/lists/oss-security/2026/04/17/5](http://www.openwall.com/lists/oss-security/2026/04/17/5)
- [https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)