CVE-2026-30912: Apache Airflow: Exposing stack trace in case of constraint error
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/exposestacktraces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30912?
CVE-2026-30912 has been classified as a medium severity vulnerability due to potential exposure of sensitive information.
How do I fix CVE-2026-30912?
To fix CVE-2026-30912, upgrade your Apache Airflow to version 3.2.0 or later.
What causes CVE-2026-30912?
CVE-2026-30912 is caused by the exposure of detailed stack traces in the API responses during SQL errors, regardless of the configuration settings.
What are the risks associated with CVE-2026-30912?
The risks associated with CVE-2026-30912 include the potential disclosure of sensitive information that could be exploited by attackers.
Is CVE-2026-30912 present in earlier versions of Apache Airflow?
Yes, CVE-2026-30912 is present in versions of Apache Airflow prior to 3.2.0.