CVE-2026-30912: Apache Airflow SQL Error Exposure Vulnerability
Summary
CVE-2026-30912: In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. Affects apache-airflow versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Also tracked for
- apache-airflow-core · PyPI
- airflow · Bitnami
- apache-airflow-core · PyPI
The same CVE-2026-30912 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to define workflows as directed acyclic graphs (DAGs) and provides a rich user interface to visualize and manage these workflows. However, it has been found to have a vulnerability that exposes sensitive information in the event of SQL errors, potentially compromising the security of the application.
Vulnerability Detail
The vulnerability arises from the improper handling of SQL errors in the Apache Airflow API. Even when the configuration setting 'api/expose_stack_traces' is set to false, the system still exposes detailed exception and stack trace information in the API responses. This could allow an attacker to gain insights into the application's internal workings, leading to further exploitation or unauthorized access. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the API or implement additional logging and monitoring to detect any unauthorized access attempts. However, upgrading to the patched version is strongly recommended for a permanent fix.
Conclusion
In summary, CVE-2026-30912 is a significant vulnerability in Apache Airflow that exposes sensitive SQL error information through its API. Users are strongly advised to upgrade to version 3.2.0 or later to ensure the security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2026-30912 is a vulnerability in Apache Airflow that exposes SQL error details in API responses, potentially allowing attackers to gain sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level that requires prompt attention.
You should upgrade to Apache Airflow version 3.2.0 or later to mitigate this vulnerability. Use the command 'pip install --upgrade apache-airflow==3.2.0' to update.
While limiting API access can serve as a temporary workaround, the best solution is to upgrade to the patched version of Apache Airflow.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
