GHSA-59x3-x3hh-x23qMediumCVSS 6.5

The Apache Airflow connections API did not mask the apprise provider's `config` connection extra,...

Published
November 9, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (1)

📋 Description

The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.

Users are advised to upgrade to apache-airflow 3.4.0 or later.

🔗 References (5)