Security · High impactFan score 21 · Tier C
CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
The Brief
- Apache Airflow's connections API did not mask the apprise provider's `config` connection extra.
- The `config` extra can contain notification-service credentials, which were returned in cleartext.
- Affected versions are Apache Airflow before 3.4.0; the issue is tracked as CVE-2026-107474 and was posted to oss-sec on Nov 8.
Why it matters
Anyone with access to the Airflow connections API on an affected version could read notification-service credentials stored in apprise connections.
Who’s affected
- Teams running Apache Airflow before 3.4.0 with the apprise provider
What to do
- Upgrade Apache Airflow to 3.4.0 or later.
- Rotate notification-service credentials stored in apprise connection configs if exposure is suspected.
- Apache Airflow before 3.4.0
- CVE-2026-107474
- #apache-airflow
- #security
- #cve-2026-107474
- #apprise
- #credentials
- #api
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow before 3.4.0 Description: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with…
Timeline
Vulnerability posted to oss-sec by Rahul Vats
Open Source Security
CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext