GitHub Advisoryadvisory · PyPI

GHSA-w7cf-2pmc-5m4c Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

MEDIUM Published 2026-04-18 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-30912
Ecosystem
PyPI
Packages
apache-airflow-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-668
Reviewed
2026-04-22

Affected packages

• PyPI apache-airflow-core: < 3.2.0 → fixed in 3.2.0

Description

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-30912 In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References