CVE-2026-30912CWE-668

Apache Airflow: Exposing stack trace in case of constraint error

High · published April 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00756 · 54.6th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-04-18T06:20Z
EPSS history
Timeline
  • 18 APR 06:20Z
    Apache Airflow: Exposing stack trace in case of constraint error
    cvelistv5