CVE-2026-30912

EUVD-2026-23662
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
apacheairflow
𝑥
< 3.2.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/apache/airflow/pull/63028
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
http://www.openwall.com/lists/oss-security/2026/04/17/5