CVE-2026-30912: Apache Airflow Information Disclosure Flaw

CVE-2026-30912 Overview

A significant information disclosure vulnerability has been identified in Apache Airflow where SQL error exception stack traces are exposed through the API even when the api/expose_stack_traces configuration option is explicitly set to false. This vulnerability allows unauthenticated remote attackers to potentially obtain sensitive internal information about the application's database structure, configuration, and implementation details through carefully crafted requests that trigger SQL errors.

Critical Impact

Attackers can bypass security configurations designed to hide error details, potentially exposing database schema information, internal file paths, and application architecture details that could facilitate further attacks.

Affected Products

• Apache Airflow versions prior to 3.2.0
• Apache Airflow deployments with API access enabled
• Apache Airflow instances where api/expose_stack_traces configuration is relied upon for security

Discovery Timeline

• 2026-04-18 - CVE CVE-2026-30912 published to NVD
• 2026-04-21 - Last updated in NVD database

Technical Details for CVE-2026-30912

Vulnerability Analysis

This vulnerability represents a classic information disclosure flaw classified under CWE-668 (Exposure of Resource to Wrong Sphere). The core issue lies in Apache Airflow's error handling mechanism for SQL-related exceptions. While the application provides a configuration option api/expose_stack_traces intended to prevent the exposure of detailed error information in production environments, this setting is not properly enforced when SQL errors occur.

When the API encounters a SQL-related exception, the error handling code path bypasses the stack trace suppression logic, resulting in full exception details being returned to the client regardless of the security configuration. This creates a false sense of security for administrators who have explicitly disabled stack trace exposure.

The vulnerability is accessible over the network without requiring authentication or user interaction. An attacker can exploit this by sending malformed API requests designed to trigger SQL errors, then analyzing the returned stack traces to gather intelligence about the target system.

Root Cause

The root cause of this vulnerability is improper error handling in the API layer where SQL exceptions follow a different code path than other exceptions. The api/expose_stack_traces configuration check is not applied consistently across all exception types, allowing SQL-related stack traces to bypass this security control. This represents a failure to implement proper exception handling uniformly throughout the codebase.

Attack Vector

The attack vector involves network-based exploitation where an attacker sends specially crafted API requests to an Apache Airflow instance. By manipulating input parameters to trigger SQL syntax errors, constraint violations, or other database exceptions, the attacker can harvest detailed stack traces containing:

• Internal file system paths revealing installation directories
• Database table and column names exposing schema information
• Python package versions and dependencies
• Internal function names and module structure
• Connection string details that may reveal database configuration

This information can be used to fingerprint the application, identify additional vulnerabilities, or craft more targeted attacks against the infrastructure.

Detection Methods for CVE-2026-30912

Indicators of Compromise

• Unusual API request patterns with malformed SQL-related parameters
• HTTP responses containing Python traceback information with SQL exception details
• Repeated API calls returning 500 Internal Server Error responses
• Log entries showing SQL syntax errors triggered by API requests
• Access logs showing probing attempts against various API endpoints

Detection Strategies

• Monitor API responses for patterns matching Python exception traces (e.g., "Traceback", "sqlalchemy.exc")
• Implement anomaly detection for API endpoints receiving malformed input
• Review web application firewall logs for SQL error triggering patterns
• Audit API access logs for reconnaissance-style request patterns

Monitoring Recommendations

• Enable detailed logging for API error responses and cross-reference with security events
• Configure alerts for elevated rates of 500-series HTTP responses from Airflow API endpoints
• Implement network-level inspection for outbound responses containing stack trace keywords
• Review Airflow audit logs regularly for suspicious API access patterns

How to Mitigate CVE-2026-30912

Immediate Actions Required

• Upgrade Apache Airflow to version 3.2.0 or later immediately
• Review and restrict network access to Airflow API endpoints using firewall rules
• Implement a web application firewall (WAF) rule to filter stack traces from responses
• Audit existing API access logs for potential exploitation attempts

Patch Information

Apache has released Apache Airflow version 3.2.0 which addresses this information disclosure vulnerability. The fix ensures that the api/expose_stack_traces configuration option is properly enforced for all exception types, including SQL-related errors. Users should upgrade to this version or later to remediate the vulnerability. For technical details about the fix, refer to the GitHub Pull Request and the Apache Mailing List Thread.

Workarounds

• Deploy a reverse proxy or WAF configured to sanitize error responses before they reach clients
• Restrict API access to trusted networks only using network segmentation
• Implement custom middleware to catch and sanitize all exception responses at the application level
• Disable or limit API access until the upgrade can be completed

# Configuration example - Restrict API access via webserver configuration
# Add to airflow.cfg or environment variables

# Ensure stack traces are disabled (note: this alone does not fix the vulnerability)
AIRFLOW__API__EXPOSE_STACK_TRACES=false

# Restrict API access to authenticated users only
AIRFLOW__API__AUTH_BACKEND=airflow.api.auth.backend.basic_auth

# Consider using network-level controls in addition
# Example iptables rule to restrict API access to internal network
# iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
# iptables -A INPUT -p tcp --dport 8080 -j DROP