https://seclists.org/oss-sec/2026/q3/984: CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage cdentials in SQL text, task logs and Teradata query logs

Q: Which deployments are most likely to be exposed?

Deployments using S3ToTeradataOperator or AzureBlobStorageToTeradataOperator with a private source bucket and no teradata_authorization_name configured are affected. This is the default credential path for both operators in affected provider versions.

Q: Who could obtain the exposed AWS credentials?

For S3ToTeradataOperator, any user with permission to view the DAG's task logs can read AWS credentials obtained through s3_hook.get_credentials(). Instance-profile or IRSA credentials are especially exposed because they are runtime credentials that were not registered with Airflow's secrets masker; the runtime STS session token is also unmasked.

Q: How can I determine whether credentials may already have been disclosed?

Check for executions of either affected operator against private source storage without teradata_authorization_name on provider versions before 3.7.0. The generated CREATE MULTISET TABLE ... LOCATION statement is logged and executed, so review Airflow task logs and Teradata query logs for credential-containing SQL.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

pypi/apache-airflow-providers-teradata<3.7.0

Frequently Asked Questions

Which deployments are most likely to be exposed?

Deployments using S3ToTeradataOperator or AzureBlobStorageToTeradataOperator with a private source bucket and no teradata_authorization_name configured are affected. This is the default credential path for both operators in affected provider versions.

Who could obtain the exposed AWS credentials?

For S3ToTeradataOperator, any user with permission to view the DAG's task logs can read AWS credentials obtained through s3_hook.get_credentials(). Instance-profile or IRSA credentials are especially exposed because they are runtime credentials that were not registered with Airflow's secrets masker; the runtime STS session token is also unmasked.

How can I determine whether credentials may already have been disclosed?

Check for executions of either affected operator against private source storage without teradata_authorization_name on provider versions before 3.7.0. The generated CREATE MULTISET TABLE ... LOCATION statement is logged and executed, so review Airflow task logs and Teradata query logs for credential-containing SQL.