Vulnerability · high
Apache Airflow Connections API returns apprise config in cleartext (CVE-2026-107474)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Airflow deployments using the apprise provider before 3.4.0
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Rotate notification-service credentials stored in apprise connection configs if exposure is suspected.
The Brief
- Apache Airflow's connections API did not mask the apprise provider's `config` connection extra.
- The `config` extra can contain notification-service credentials, which were returned in cleartext.
- Affected versions are Apache Airflow before 3.4.0; the issue is tracked as CVE-2026-107474 and was posted to oss-sec on Nov 8.
Why it matters
Anyone with access to the Airflow connections API on an affected version could read notification-service credentials stored in apprise connections.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Airflow is an orchestration tool that developers and ops teams build with and run. |
| No | Core infrastructure | Judgment: Airflow is a single popular product, not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Apache Airflow is a widely used workflow orchestration platform across many data teams. |
| No | Exploited in the wild | Open Source Security: the advisory describes the flaw only; no observed attacks reported. |
| No | Public exploit | Open Source Security: only an advisory is given; no exploit code or PoC mentioned. |
| No | Remote, no login | Open Source Security: the description says 'A user with…', implying an authenticated account is needed. |
| No | Full takeover | Open Source Security: the flaw is an unmasked config value returned by the API, i.e. information disclosure, not code execution. |
| No | Secrets exposed | Open Source Security: the API did not mask the config extra; no source says credentials were actually stolen or exposed. |
| No | Supply chain | Open Source Security: a normal flaw in legitimate code; no malicious code shipped. |
| No | No fix yet | Open Source Security: affected versions are 'before 3.4.0', indicating a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability posted to oss-sec by Rahul Vats
Open Source Security
CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
Source
CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided