CVE-2026-107474 · Package
NO FIX YET · SEE WHAT TO DO
The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can contain notification-service credentials. A user allowed to read connections can retrieve those credentials in cleartext.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Airflow with the apprise provider and connections that store notification credentials in the config extra. Users who can read connections can see those credentials. Airflow 3 treats connection credentials as write-only, so the exposure is limited to the apprise config extra as described in the sources.
Not affected if apprise-provider-not-installed, no-apprise-connections
Who cares apache-airflow, apprise, self-hosted
airflow version and the apprise provider with pip show apache-airflow-providers-appriseconfig extra3.4.0 or laterThe Apache Airflow connections API did not mask the apprise provider's config connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.
Users are advised to upgrade to apache-airflow 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.