CVE-2026-30912
Information Disclosure via SQL Error Stack Trace in Apache Airflow API
Publication date: 2026-04-18
Last updated on: 2026-04-21
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | airflow | to 3.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-668 | The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when SQL errors cause exception or stack trace information to be exposed through the API, even if the configuration setting "api/expose_stack_traces" is set to false.
This unintended exposure can reveal additional internal information about the system to potential attackers.
The issue affects Apache Airflow and is fixed in version 3.2.0.
How can this vulnerability impact me? :
The vulnerability can lead to the exposure of sensitive internal information through error messages and stack traces.
Attackers could use this information to better understand the system, potentially aiding in further attacks or exploitation.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue of exposing exception/stack trace errors in the API even when the "api/expose_stack_traces" setting is false.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability causes SQL error stack traces to be exposed via the API even when the configuration to hide them is enabled. This exposure of additional information could potentially lead to unauthorized access or data leakage.
Such unintended information disclosure may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of information leakage.
Users are recommended to upgrade to Apache Airflow 3.2.0 to fix this issue and reduce the risk of non-compliance.