PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45192 Apache Software Foundation CVE debrief

A vulnerability in Apache Airflow's GET /api/v2/connections/{connection_id} REST API endpoint allowed authenticated users with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob when those secrets were stored under field names not present in the default redaction allowlist (DEFAULT_SENSITIVE_FIELDS). The issue was disclosed on 2026-06-01 and affects deployments that store credentials in Connection extra blobs and grant Connection-read access to multiple users. The vulnerability is classified as CWE-200 (Information Exposure).

Vendor
Apache Software Foundation
Product
Apache Airflow
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-21
Advisory published
2026-06-01
Advisory updated
2026-07-21

Who should care

Organizations running Apache Airflow with multiple users granted Connection-read permissions and storing credentials in Connection extra fields. Security teams managing secret rotation and access control for Airflow deployments. DevOps engineers responsible for Airflow configuration and secret backend integration.

Technical summary

An authenticated UI or API user with Connection-read permission in Apache Airflow could retrieve plaintext secrets from a Connection's extra JSON blob when those secrets were stored under field names not included in DEFAULT_SENSITIVE_FIELDS. The GET /api/v2/connections/{connection_id} endpoint failed to redact these values. This exposes credentials for providers such as the official Slack integration when stored in extra fields. Deployments using secret backends rather than inlined extra fields are not affected by this specific exposure vector.

Defensive priority

high

Recommended defensive actions

  • Upgrade to apache-airflow 3.2.2 or later to address the incomplete secret redaction in the connections API endpoint.
  • As a defense-in-depth measure, migrate sensitive credential values from Connection extra fields to a secret backend to reduce exposure surface.
  • Review and audit Connection-read permissions to ensure least-privilege access, particularly in multi-user deployments.
  • Evaluate custom extra field names in use and verify they are covered by sensitive field redaction policies.

Evidence notes

The vulnerability description indicates that official Slack-provider credential field names were returned in plaintext as an example of non-allowlisted fields. The fix is available in apache-airflow 3.2.2 or later. The weakness is identified as CWE-200 per source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45192 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45192

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45192 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45192

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.