CVE-2026-107474
— UNSCOREDpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
Weaknesses
CWE-522
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- LOWCVE-2026-100264
- HIGHCVE-2026-100298
- MEDIUMCVE-2026-100569PoC
- UNSCOREDCVE-2026-101034
- LOWCVE-2026-101089PoC
- HIGHCVE-2026-101331
- HIGHCVE-2026-102944PoC
- UNSCOREDCVE-2026-103090PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.