CVE-2026-45192: Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response
A bug in the GET /api/v2/connections/{connectionid} REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob under field names not present in the redaction allowlist (DEFAULTSENSITIVEFIELDS) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection extra blobs and grant Connection-read access to multiple users. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's extra field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflowto a version that resolves this vulnerability.Fixed in 3.2.2 - Compensating control
Use a secret backend to store sensitive credential values instead of inlining them into Apache Airflow Connection `extra` JSON blobs (defense-in-depth mitigation).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45192?
CVE-2026-45192 has a severity rating of medium with a CVSS score of 6.5.
How do I fix CVE-2026-45192?
To fix CVE-2026-45192, apply the available patch released by Apache.
What kind of data is exposed by CVE-2026-45192?
CVE-2026-45192 allows an authenticated user to access sensitive secrets in the Connection's `extra` JSON blob.
What are the potential impacts of CVE-2026-45192?
The potential impact of CVE-2026-45192 includes unauthorized disclosure of sensitive information stored in Apache Airflow connections.
Which version of Apache Airflow is affected by CVE-2026-45192?
CVE-2026-45192 affects versions of Apache Airflow that contain the vulnerable GET `/api/v2/connections/{connection_id}` endpoint.