CVE-2026-30912

HIGH

7.5

Description

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/18/2026

Last Modified4/21/2026

Sourcenvd

Honeypot Sightings0

Affected Products

apache:airflow

Weaknesses (CWE)

CWE-668

References

https://github.com/apache/airflow/pull/63028(security@apache.org)

https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9(security@apache.org)

http://www.openwall.com/lists/oss-security/2026/04/17/5(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.