Description
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.
Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 2.4.0 – < 3.0.0, < 3.4.0 | 3.0.0 |
Advisories 1
- WID-SEC-2026-4401 Apache Airflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026