CVE-2026-45192

MediumCVSS 6.5/10Last modified Jul 21, 2026

Description

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-451957.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outsCVE-2026-451967.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access whichCVE-2026-451972.5Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data oCVE-2026-451987.8Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot CVE-2026-451997.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-452007.8Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when fCVE-2026-452017.8Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating phyCVE-2026-452025.5Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruCVE-2026-452037.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the CVE-2026-452045.5Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereCVE-2026-452055.3Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw aCVE-2026-452067.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.
CVE-2026-45192: Medium severity, CVSS 6.5 | Vulnix