CVE-2026-43826 Details
Description
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.
A vulnerability exists in the OpenSearch logging provider of Apache Airflow, specifically in versions prior to 1.9.1. When the host URL is configured to include credentials, such as in the format 'https://user:[email protected]:9200', the full URL with the embedded credentials is logged in task logs. This allows any user with permission to read task logs to access the backend credentials. To address this issue, users should upgrade to 'apache-airflow-providers-opensearch' version 1.9.1 or later. Additionally, as a defense-in-depth measure, it is recommended to configure backend credentials using a secret backend instead of embedding them in the OpenSearch host URL.
Upgrade to 'apache-airflow-providers-opensearch' version 1.9.1 or later. As a defense-in-depth measure, configure backend credentials via a secret backend instead of embedding them in the OpenSearch host URL.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/10/2 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/65509 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-opensearch | < 1.9.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CVE |
| May 11, 2026 | New CVE Received | [email protected] |