https://seclists.org/oss-sec/2026/q4/592: CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
Published Nov 9, 2026
·Updated
Affected Software
1 affected component
Apache Airflow<3.4.0
A user who has permission to read connections in Apache Airflow can retrieve the Apprise connection extra named "config" in cleartext. The exposed value can contain credentials for notification services.
Deployments using Apache Airflow before 3.4.0 are affected if they use Apprise connections whose "config" extra contains sensitive notification-service credentials. Exploitation also requires a user with permission to read connections.
Upgrade Apache Airflow to version 3.4.0 or later.
Review whether affected Airflow instances have Apprise connections with a "config" extra that embeds notification-service credentials, and identify users with permission to read connections. Those users could have retrieved the value in cleartext before remediation.