CVE-2026-30912 json
Apache Airflow: Exposing stack trace in case of constraint error
published 2026-04-18 6 mo ago modified 2026-11-03 6 d ago also BIT-airflow-2026-30912 , EUVD-2026-23662 , GHSA-w7cf-2pmc-5m4c , PYSEC-2026-18 , PYSEC-2026-2361
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
Patch / fix
- pypi apache-airflow-core 3.2.0
- bitnami airflow 3.2.0
- pypi apache-airflow 3.2.0
- Apache Software Foundation Apache Airflow 3.0.0, 3.2.0
- github.com/apache/airflow#63028 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow-core | <3.2.0 |
3.2.0 |
| bitnami | airflow | <3.2.0 |
3.2.0 |
| pypi | apache-airflow | <3.2.0 |
3.2.0 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-668 Exposure of Resource to Wrong Sphere
References
-
github.com
/apache/airflow/pull/63028
patch, web, issue-tracking, report
-
lists.apache.org
/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/04/17/5
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-30912
advisory, web
-
github.com
/apache/airflow
web
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml
web
-
pypi.org
/project/apache-airflow-core
package
-
github.com
/advisories/GHSA-w7cf-2pmc-5m4c
advisory
Sources
- CVE List CVE-2026-30912
- GitHub Advisory GHSA-w7cf-2pmc-5m4c
- NVD CVE-2026-30912
- OSV BIT-airflow-2026-30912
- OSV PYSEC-2026-18
- OSV PYSEC-2026-2361
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.