CVE-2026-30912: Apache Airflow Stack Trace Exposure in API Responses
Summary
CVE-2026-30912: Apache Airflow: Exposing stack trace in case of constraint error. Affects airflow versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Also tracked for
- apache-airflow-core · PyPI
- apache-airflow-core · PyPI
- apache-airflow · PyPI
The same CVE-2026-30912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as Directed Acyclic Graphs (DAGs) of tasks, providing a rich user interface to visualize and manage these workflows. However, a vulnerability has been identified that exposes sensitive stack trace information in API responses, potentially leading to information leakage.
Vulnerability Detail
The vulnerability arises from the improper handling of SQL errors within the Apache Airflow API. Even when the configuration option 'api/expose_stack_traces' is set to false, the API still exposes detailed exception and stack trace information in the event of a constraint error. This can provide attackers with insights into the underlying system architecture and database structure, increasing the risk of further exploitation.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can ensure that the 'api/expose_stack_traces' setting is set to false in their configuration file. However, this does not fully mitigate the risk, and upgrading is strongly recommended.
Conclusion
In summary, CVE-2026-30912 is a significant vulnerability in Apache Airflow that can lead to the exposure of sensitive stack trace information through API responses. Users are strongly advised to upgrade to version 3.2.0 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-30912 is a vulnerability in Apache Airflow that exposes stack trace information in API responses, even when configured not to do so.
If your application uses Apache Airflow and is affected by this vulnerability, it may expose sensitive information that could be exploited by attackers.
All versions prior to 3.2.0 are affected by this vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If an immediate upgrade is not possible, ensure that the 'api/expose_stack_traces' setting is set to false as a temporary measure, but plan to upgrade as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
