CVE-2026-30912

7.5 HIGH
Published: April 18, 2026 Modified: April 21, 2026
View on NVD

Description

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/apache/airflow/pull/63028
Source: security@apache.org
Issue Tracking
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
Source: security@apache.org
Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2026/04/17/5
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory

3 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
0.4%
36th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

Affected Vendors

apache