# CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/592) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-107474-apache-airflow-connections-api-apprise-connection-config-extra-r-867d29f2ef034498
Kind: security · Impact: high

## In brief

- Apache Airflow's connections API did not mask the apprise provider's `config` connection extra.
- The `config` extra can contain notification-service credentials, which were returned in cleartext.
- Affected versions are Apache Airflow before 3.4.0; the issue is tracked as CVE-2026-107474 and was posted to oss-sec on Nov 8.

## Why it matters

Anyone with access to the Airflow connections API on an affected version could read notification-service credentials stored in apprise connections.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later.
- Rotate notification-service credentials stored in apprise connection configs if exposure is suspected.

## Versions

- Apache Airflow before 3.4.0

## CVEs

- CVE-2026-107474

## Timeline

- 2026-11-08: Vulnerability posted to oss-sec by Rahul Vats

## Coverage

- [CVE-2026-107474: Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext](https://seclists.org/oss-sec/2026/q4/592) — Open Source Security, 2026-11-09

Tags: apache-airflow, security, cve-2026-107474, apprise, credentials, api

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev