GitHub Advisoryadvisory · PyPI

GHSA-xccp-97wp-3gjg Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL

MEDIUM Published 2026-05-11 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-43826
Ecosystem
PyPI
Packages
apache-airflow-providers-opensearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2026-05-15

Affected packages

• PyPI apache-airflow-providers-opensearch: < 1.9.1 → fixed in 1.9.1

Description

The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.

Related

Alias · CVE (1)

  • CVE-2026-43826 The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References