CVE-2026-41018 Details
Description
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.
A vulnerability exists in the Elasticsearch logging provider of Apache Airflow Providers Elasticsearch, in versions prior to 6.5.3. When the logging provider is configured with a host URL that includes credentials, such as 'https://user:[email protected]:9200', the full URL with the embedded credentials is logged in task logs. This allows any user with permission to read task logs to access the backend credentials. The issue arises from the logging provider's handling of URLs with embedded credentials, which are not properly sanitized before being written to the log.
Users are advised to upgrade to Apache Airflow Providers Elasticsearch version 6.5.3 or later. As an additional security measure, configure backend credentials using a secret backend instead of embedding them in the Elasticsearch host URL.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/10/3 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/65349 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7 | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-elasticsearch | < 6.5.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CVE |
| May 11, 2026 | New CVE Received | [email protected] |