Junglewise Threat Intelligence

CVE-2026-43826: Apache Airflow OpenSearch Provider credential leak in task logs

CVE-2026-43826 · Severity: medium · CVSS 6.5 · Published 2026-05-11

Vendors: Apache Software Foundation, PyPI.

Executive brief

Apache Airflow's OpenSearch logging provider contains a flaw where it inadvertently records sensitive login credentials in task logs. If an administrator configures the connection using a URL that includes a username and password, those details are written in plain text to the logs. Any user with permission to view these logs can see the credentials, potentially allowing them to gain unauthorized access to the OpenSearch database.

Technical details

A vulnerability in the Apache Airflow OpenSearch provider (CWE-532) occurs when the `[opensearch] host` configuration contains embedded credentials (e.g., `https://user:password@host`). The `_group_logs_by_host` method in `OpensearchTaskHandler` and `OpensearchRemoteLogIO` used the raw host URL as a dictionary key for log-source labeling, causing the full URL—including credentials—to be written into task logs. An attacker with low-privileged access to read task logs can extract these credentials. The issue was resolved in version 1.9.1 by implementing a helper to strip user information from the URL before it is used for logging labels.

Affected products

  • Apache Software Foundation apache-airflow-providers-opensearch < 1.9.1

Timeline

  • 2026-04-19: patched: Fix merged into main branch via PR 65509
  • 2026-05-10: disclosed: Mailing list announcement on oss-security
  • 2026-05-11: advisory: GitHub Advisory and NVD publication

References