Apache Airflow Providers OpenSearch und Elasticsearch: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Summary

Product

Vulnerabilities 2

• Medium 6.5
  CVE-2026-41018

  Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL

  The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log …

  Apache Software Foundation Apache Airflow Providers Elasticsearch airflow-3 elasticsearch Ubuntu Wolfi PyPI
  May 11, 2026
• Medium 6.5
  CVE-2026-43826

  Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL

  The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log rea…

  Apache Software Foundation Apache Airflow Providers OpenSearch opensearch apache-airflow-providers-opensearch Ubuntu PyPI
  May 11, 2026

Revision history

1. 2026-05-11 #2

   Referenz(en) aufgenommen: EUVD-2026-29040, EUVD-2026-29042

2. 2026-05-10 #1

   Initiale Fassung

References

• Apache Announce vom 2026-05-10
  https://lists.apache.org/thread/6r98flv2vfqvwd7tvdqow3jqw77hg3vz
• Apache Announce vom 2026-05-10
  https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y
• CVERecord vom 2026-05-10
  https://www.cve.org/CVERecord?id=CVE-2026-41018
• CVERecord vom 2026-05-10
  https://www.cve.org/CVERecord?id=CVE-2026-43826