Database/Control plane, storage & DevOps
Apache Airflow: SQL error stack traces returned by the API despite expose_stack_traces=false
Impact
On a SQL error the Airflow API returns the exception and stack trace even when api/expose_stack_traces is set to false, so an operator who deliberately turned the setting off still leaks internal detail. What comes back is the metadata database schema, query fragments, file paths and installed component versions - the reconnaissance an attacker needs to aim a follow-up at the Airflow metadata DB that holds connections and pipeline definitions for the fleet's training and batch jobs. The record describes information disclosure only; it does not report code execution or data modification through this path.
Who can reach it
Anyone who can reach the Airflow API endpoint and provoke a SQL error. NVD scores it as requiring no privileges (PR:N); on a deployment with authentication in front of the API, a caller who can reach the endpoint.
What to do
Upgrade to Apache Airflow 3.2.0 and restart the API server - a control-plane daemon restart, no node drain. Keep the API off any network a tenant can reach in the meantime; the configuration flag alone does not suppress the traces on affected versions.
References
Related entries
- Apache Airflow: task JWT tokens written to logs let UI users act as Dag authorsCVE-2026-31987 · Apache Airflow (task JWT tokens in logs)High
- Apache Airflow: asset materialize permission lets a user trigger DAGs they have no access toCVE-2026-32228 · Apache Airflow (asset materialize permission)High
- Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trust: This is the vendor formally concedingCVE-2026-32666 · Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trustHigh
- Apache Tomcat: Missing encryption of sensitive data introduced by the CVE-2026-29146 fixCVE-2026-34486 · Apache TomcatHigh
- Apache Airflow: bulk Task Instance API authorizes the URL dag_id but acts on the body dag_idCVE-2026-41084 · Apache Airflow (bulk Task Instances API, PATCH/DELETE authorization)High
- JFrog Artifactory: internal anonymous-user token returned to unauthenticated callersCVE-2026-42018 · JFrog Artifactory (anonymous-user token disclosure)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.