PT-2026-39578
CVE-2026-41018
·
Published
2026-05-11
·
Updated
2026-09-18
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
apache-airflow-providers-elasticsearch versions prior to 6.5.3
Description
The Elasticsearch logging provider writes the full host URL into task logs when configured with a
host URL that embeds credentials. This allows any user with task-log read permissions to harvest the backend credentials.Recommendations
Upgrade to version 6.5.3 or later.
Configure backend credentials via a secret backend instead of embedding them in the
host URL.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾