{"id":"CVE-2026-107474","kind":"vulnerability","aliases":["CVE-2026-107474"],"related":[],"title":"Apache Airflow: apprise connection secrets exposed through connections API","description":"The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later.","summary":"The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can contain notification-service credentials. A user allowed to read connections can retrieve those credentials in cleartext.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","apprise","package","self-hosted"],"not_affected_if":["apprise-provider-not-installed","no-apprise-connections"],"how_to_check":"- Check the installed Airflow version with `airflow version` and the apprise provider with `pip show apache-airflow-providers-apprise`\n- Look for connections that use the apprise provider and store secrets in the `config` extra","fix":"- apache-airflow `3.4.0` or later","status":"open","published_at":"2026-11-09T10:17:02+00:00","first_seen_at":"2026-11-09T10:25:47+00:00","triaged_at":"2026-11-09T10:26:53+00:00","updated_at":"2026-11-09T10:26:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:53Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow `3.4.0` or later","reach":"network","title":"Apache Airflow: apprise connection secrets exposed through connections API","impact":"medium","summary":"The Apache Airflow connections API did not mask the apprise provider's config connection extra, which can contain notification-service credentials. A user allowed to read connections can retrieve those credentials in cleartext.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-airflow","self-hosted","apprise"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"notification-service credentials readable in cleartext by authorized users","analyst_note":"","how_to_check":"- Check the installed Airflow version with `airflow version` and the apprise provider with `pip show apache-airflow-providers-apprise`\n- Look for connections that use the apprise provider and store secrets in the `config` extra","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["apprise-provider-not-installed","no-apprise-connections"],"who_is_affected":"Teams running Apache Airflow with the apprise provider and connections that store notification credentials in the config extra. Users who can read connections can see those credentials. Airflow 3 treats connection credentials as write-only, so the exposure is limited to the apprise config extra as described in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4554,"output_tokens":518,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107474':12A,15A '-2026':11A,14A '3':94C '3.4.0':111C 'advis':104C 'airflow':2A,18B,26B,60C,93C,110C 'allow':48B 'although':92C 'apach':1A,17B,25B,59C,109C 'apache-airflow':16B,108C 'api':9A,28B,62C 'appris':3A,19B,33B,67C 'cleartext':57B,91C 'config':36B,70C 'connect':4A,8A,27B,37B,51B,61C,71C,86C,96C 'contain':41B 'could':87C 'credenti':45B,55B,79C,97C 'cve':10A,13A 'emb':75C 'expos':6A 'extra':38B,72C 'host':23B 'later':113C 'mask':31B,65C 'notif':43B,77C 'notification-servic':42B,76C 'packag':20B 'permiss':83C 'provid':34B,68C 'read':50B,85C 'retriev':53B,88C 'secret':5A 'self':22B 'self-host':21B 'servic':44B,78C 'treat':95C 'upgrad':106C 'user':47B,81C,102C 'write':100C 'write-on':99C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow with the apprise provider and connections that store notification credentials in the config extra. Users who can read connections can see those credentials. Airflow 3 treats connection credentials as write-only, so the exposure is limited to the apprise config extra as described in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","apprise","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-107474':12A,15A '-2026':11A,14A 'airflow':2A 'apach':1A 'api':9A 'appris':3A 'connect':4A,8A 'cve':10A,13A 'expos':6A 'secret':5A","search_b":"'airflow':18B,26B 'allow':48B 'apach':17B,25B 'apache-airflow':16B 'api':28B 'appris':19B,33B 'cleartext':57B 'config':36B 'connect':27B,37B,51B 'contain':41B 'credenti':45B,55B 'extra':38B 'host':23B 'mask':31B 'notif':43B 'notification-servic':42B 'packag':20B 'provid':34B 'read':50B 'retriev':53B 'self':22B 'self-host':21B 'servic':44B 'user':47B","search_c":"'3':94C '3.4.0':111C 'advis':104C 'airflow':60C,93C,110C 'although':92C 'apach':59C,109C 'apache-airflow':108C 'api':62C 'appris':67C 'cleartext':91C 'config':70C 'connect':61C,71C,86C,96C 'could':87C 'credenti':79C,97C 'emb':75C 'extra':72C 'later':113C 'mask':65C 'notif':77C 'notification-servic':76C 'permiss':83C 'provid':68C 'read':85C 'retriev':88C 'servic':78C 'treat':95C 'upgrad':106C 'user':81C,102C 'write':100C 'write-on':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107474","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107474","severity":null,"published_at":"2026-11-09T10:17:02+00:00","modified_at":"2026-11-09T10:17:02+00:00","first_seen_at":"2026-11-09T10:25:47+00:00","fetched_at":"2026-11-09T10:25:47+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}