PT-2026-140274

CVE-2026-107474

·

Published

2026-11-09

·

Updated

2026-11-09

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.
Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-522: Insufficiently Protected Credentials
Related identifiers
CVE-2026-107474
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com