PyPI: apache-airflow-core
CVE-2026-30912
Safety vulnerability ID: SFTY-20260418-69352
Safety legacy ID: pyup.io-95051
Affected versions of the apache-airflow-core package are vulnerable to Information Disclosure due to the api/expose_stack_traces configuration setting being ignored when SQL errors occur. When a SQL error is raised, the exception details and stack trace are returned through the API even if api/expose_stack_traces is set to false, bypassing the intended suppression behaviour. A potential attacker who triggers a SQL error through the API can obtain internal stack trace information that should have been withheld, exposing implementation details about the system.
Overview
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
Advisory
Affected versions of the apache-airflow-core package are vulnerable to Information Disclosure due to the api/expose_stack_traces configuration setting being ignored when SQL errors occur. When a SQL error is raised, the exception details and stack trace are returned through the API even if api/expose_stack_traces is set to false, bypassing the intended suppression behaviour. A potential attacker who triggers a SQL error through the API can obtain internal stack trace information that should have been withheld, exposing implementation details about the system.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260418-69352/CVE-2026-30912
- https://nvd.nist.gov/vuln/detail/CVE-2026-30912
- https://github.com/apache/airflow/pull/63028
- https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
- http://www.openwall.com/lists/oss-security/2026/04/17/5
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml
- https://github.com/advisories/GHSA-w7cf-2pmc-5m4c
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more