CVE-2026-45192: Apache Airflow Connection API Credential Leak – CVSS 6.5

Technical summary

The GET `/api/v2/connections/{connection_id}` endpoint in Apache Airflow uses a hardcoded allowlist (`DEFAULT_SENSITIVE_FIELDS`) to identify which JSON keys within a Connection's `extra` blob should be redacted before returning to the caller. The vulnerability stems from the fact that different credential providers use varying field names for the same credential type—official Slack provider fields, for instance, are not in the default allowlist. An authenticated attacker with Connection-read permission can request connection details and receive unredacted secrets for any field name absent from the allowlist, enabling credential exfiltration without further privilege escalation.

Business impact

In multi-user Airflow deployments, this vulnerability enables lateral privilege escalation and credential theft. Users granted standard connection-read access—often necessary for DAG development and troubleshooting—can harvest production credentials for external services (databases, APIs, cloud platforms) embedded in connections. Compromised credentials can then be used to access data warehouses, trigger unauthorized workflows in dependent systems, or pivot to further infrastructure compromise. Organizations with shared Airflow environments or federated access control are at highest risk.

Affected systems

Apache Airflow deployments storing credentials directly in Connection `extra` JSON fields and granting Connection-read permission to multiple users or teams. The vulnerability affects all versions prior to 3.2.2. Deployments that exclusively use secret backends (e.g., Kubernetes Secrets, AWS Secrets Manager) for credential storage are unaffected, as are single-operator or fully trusted environments where all users can already access all secrets.

Exploitability

Exploitability is straightforward: the attacker must already have valid Airflow credentials and Connection-read permission (a common, non-privileged role). No complex multi-step attack or special network access is required—a simple REST API call or UI navigation exposes the secrets. The only barrier is authentication; once inside, extraction is trivial. This makes it a practical, low-friction attack vector in any environment where access control boundaries exist between users.

Remediation

Upgrade Apache Airflow to version 3.2.2 or later, which corrects the redaction logic to properly mask sensitive fields across provider implementations. As a defense-in-depth strategy, operators should migrate credential storage away from inline Connection `extra` fields and into a dedicated secret backend (Kubernetes Secrets, HashiCorp Vault, AWS Secrets Manager, etc.). This eliminates the attack surface entirely and improves credential rotation and audit logging.

Patch guidance

Apply the upgrade to apache-airflow 3.2.2 or later as soon as feasible. If immediate patching is not possible, implement network or API gateway restrictions to limit who can call `/api/v2/connections/*` endpoints, and audit all recent connection API access logs to identify potential credential exfiltration. Verify that your deployment does not expose connection endpoints to untrusted networks. Test the patch in a non-production environment to ensure compatibility with custom providers or middleware before production rollout.

Detection guidance

Monitor Airflow API audit logs for repeated or bulk requests to GET `/api/v2/connections/` endpoints, especially from service accounts or users outside normal DAG development patterns. Search for successful responses containing unredacted credential-like strings (API keys, bearer tokens, passwords) in the `extra` field. Correlate connection API access with subsequent authentication attempts to external systems using harvested credentials. Review IAM and Connection-read permission grants; identify overly broad access and implement least-privilege review. In secret-backend deployments, confirm that Connection `extra` fields remain empty or contain only non-sensitive metadata.

Why prioritize this

A CVSS 6.5 MEDIUM score reflecting high confidentiality impact but no integrity or availability risk. However, the practical severity is elevated by the ease of exploitation, the prevalence of multi-user Airflow setups, and the value of Airflow credentials as a stepping stone to data and compute infrastructure. Prioritize remediation in environments where connection-read permission is granted to development teams, contractors, or cross-functional groups. Single-operator or fully air-gapped deployments can be deprioritized.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible API (AV:N) with low complexity (AC:L) that requires authentication (PR:L) but no user interaction (UI:N), delivering high confidentiality impact (C:H) but no integrity or availability damage (I:N, A:N). The score is appropriate for an information-disclosure flaw in a sensitive API; however, organizational risk depends heavily on deployment topology and access control posture. Environments with strict, role-based connection permissions and secret-backend storage face significantly lower risk than those relying on inline credentials and broad API access.

Frequently asked questions