CVE-2026-45192

{"id": "CVE-2026-45192", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45192", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T12:52:50.106367Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.2", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-06-01T08:16:20.567", "references": [{"url": "https://github.com/apache/airflow/pull/66673", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/01/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) \u2014 for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field."}, {"lang": "es", "value": "Un error en el endpoint de la API REST GET '/api/v2/connections/{connection_id}' en Apache Airflow permiti\u00f3 a un usuario autenticado de UI/API con permiso de lectura de Conexi\u00f3n recuperar secretos almacenados en un blob JSON extra de una Conexi\u00f3n bajo nombres de campo no presentes en la lista de permitidos de redacci\u00f3n ( DEFAULT_SENSITIVE_FIELDS ) \u2014 por ejemplo, los nombres de campo de credenciales oficiales del proveedor de Slack se devolvieron en texto plano. Afecta a las implementaciones que almacenan credenciales en blobs extra de Conexi\u00f3n y otorgan acceso de lectura de Conexi\u00f3n a m\u00faltiples usuarios. Se aconseja a los usuarios actualizar a apache-airflow 3.2.2 o posterior. Como una mitigaci\u00f3n de defensa en profundidad, los operadores de implementaci\u00f3n pueden almacenar valores de credenciales sensibles en un backend de secretos en lugar de incrustados en el campo extra de la Conexi\u00f3n."}], "lastModified": "2026-07-21T18:10:00.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0893C3AA-26A4-4682-A36C-05E719EB2943", "versionEndExcluding": "3.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}