Junglewise Threat Intelligence

CVE-2026-41018: Apache Airflow Elasticsearch Provider credential leak in task logs

CVE-2026-41018 · Severity: medium · CVSS 6.5 · Published 2026-05-11

Vendors: Apache Software Foundation, Apache, PyPI.

Executive brief

Apache Airflow's Elasticsearch logging component contains a flaw that accidentally records sensitive login credentials in task logs. If an administrator includes a username and password in the Elasticsearch connection URL, those details are written in plain text to the logs. Any user with permission to view task logs can see these credentials, potentially allowing them to gain unauthorized access to the organization's Elasticsearch database.

Technical details

A vulnerability in the Elasticsearch task-log handler (CWE-532) causes the full host URL to be used as a dictionary key when grouping log hits. When the `[elasticsearch] host` configuration contains embedded 'userinfo' (e.g., https://user:password@host), the handler fails to redact these credentials before writing them to the task logs. An attacker with low-privileged network access and task-log read permissions can extract these credentials from the log output. The issue is resolved in version 6.5.3 by implementing a helper to strip user information from the URL before it is used as a log label.

Affected products

  • Apache apache-airflow-providers-elasticsearch < 6.5.3

Timeline

  • 2026-04-16: patched: Pull request merged to strip userinfo from ES host URL
  • 2026-05-11: advisory: GitHub and NVD advisory published
  • 2026-05-11: disclosed: CVE-2026-41018 assigned

References