CVE-2026-45192 Details
Description
A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field.
A vulnerability exists in the GET '/api/v2/connections/{connection_id}' REST API endpoint of Apache Airflow, prior to version 3.2.2. This issue allows authenticated users with Connection-read permission to access unredacted secrets from a Connection's 'extra' JSON blob. The vulnerability arises because certain field names, such as those related to official Slack-provider credentials, were not included in the redaction allowlist, 'DEFAULT_SENSITIVE_FIELDS', leading to the exposure of sensitive information in plaintext. This issue impacts deployments that store credentials in Connection 'extra' blobs and provide Connection-read access to multiple users.
Users are advised to upgrade to Apache Airflow version 3.2.2 or later. As an additional mitigation, deployment operators can use a secret backend to store sensitive credential values instead of embedding them directly in the Connection's 'extra' field.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/06/01/3 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/66673 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.2.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CVE |
| Jun 1, 2026 | New CVE Received | [email protected] |