CVE-2026-43826: Apache Airflow OpenSearch Info Leak

CVE-2026-43826 Overview

CVE-2026-43826 affects the Apache Airflow OpenSearch provider package (apache-airflow-providers-opensearch). When operators configure the provider with a host URL that embeds credentials (for example https://user:password@server.example.com:9200), the provider writes the full URL into task logs. Any authenticated user with task-log read permission can harvest the backend OpenSearch credentials from those logs. The flaw maps to [CWE-532: Insertion of Sensitive Information into Log File]. Apache resolved the issue in apache-airflow-providers-opensearch 1.9.1.

Critical Impact

Authenticated Airflow users with task-log read access can extract backend OpenSearch credentials from log output, enabling lateral movement into the OpenSearch cluster.

Affected Products

• Apache Airflow OpenSearch provider (apache-airflow-providers-opensearch) versions prior to 1.9.1
• Airflow deployments configuring [opensearch] host with embedded basic-auth credentials
• Environments granting broad task-log read permissions to operational users

Discovery Timeline

• 2026-05-11 - CVE-2026-43826 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43826

Vulnerability Analysis

The OpenSearch logging provider initializes its client using a connection host string. When that string contains basic-auth credentials in the URL userinfo segment, the provider serializes the unmodified URL into diagnostic and task log output. Airflow task logs are accessible through the web UI and the REST API to any user holding task-log read permissions. The credential leak therefore expands the trust boundary from infrastructure operators to every Airflow user with log visibility.

The vulnerability falls under [CWE-532] because sensitive authentication material is written into a log sink intended for operational debugging. The provider does not redact the userinfo component before logging, and Airflow's log retention policies typically preserve the data for the lifetime of the DAG run history.

Root Cause

The root cause is missing sanitization of credentials embedded in the host configuration value before the provider emits log messages. The provider treats the connection string as opaque text rather than parsing the URL and masking the user:password@ segment. This is a logging hygiene defect rather than a protocol or cryptographic weakness.

Attack Vector

An authenticated Airflow user navigates to a task instance log, or queries the logs API, for any task that exercised the OpenSearch provider. The leaked URL appears in plaintext within the log body. The attacker copies the credentials and authenticates directly to the OpenSearch cluster, bypassing Airflow's role boundaries. The attack requires low privileges and no user interaction, and works over the network through the standard Airflow web interface.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the Apache Airflow Pull Request 65509 for the upstream fix details.

Detection Methods for CVE-2026-43826

Indicators of Compromise

• Task log entries from the OpenSearch provider containing URL patterns matching https?://[^:]+:[^@]+@ in the host field
• Unexpected OpenSearch authentication events originating from Airflow user workstations or IP ranges outside the Airflow worker subnet
• Access requests to task-log endpoints (/api/v1/dags/*/dagRuns/*/taskInstances/*/logs/*) from accounts that do not normally interact with OpenSearch-backed DAGs

Detection Strategies

• Scan historical Airflow task logs for embedded-credential URL patterns and inventory exposed accounts for rotation.
• Correlate Airflow audit logs with OpenSearch authentication logs to identify principals reusing credentials harvested from logs.
• Alert on installed apache-airflow-providers-opensearch package versions below 1.9.1 across Airflow workers and schedulers.

Monitoring Recommendations

• Forward Airflow webserver and worker logs to a central analytics platform and apply regex detections for credential-bearing URLs.
• Monitor OpenSearch security audit logs for the specific service account configured in [opensearch] host and alert on logins from unexpected sources.
• Track configuration drift on airflow.cfg and environment variables to detect reintroduction of inline credentials after remediation.

How to Mitigate CVE-2026-43826

Immediate Actions Required

• Upgrade apache-airflow-providers-opensearch to version 1.9.1 or later on all Airflow components.
• Rotate any OpenSearch credentials that were previously configured in the [opensearch] host URL, treating them as compromised.
• Purge or restrict access to historical task logs that may contain the leaked URL until rotation is complete.

Patch Information

Apache fixed the issue in apache-airflow-providers-opensearch 1.9.1. The upstream change is tracked in the Apache Airflow GitHub Pull Request 65509 and announced on the Apache Airflow Security Mailing List and the Openwall OSS Security Update.

Workarounds

• Move OpenSearch credentials out of the host URL and store them in an Airflow secret backend such as HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager.
• Restrict the Airflow can_read permission on task logs to a minimal set of operational roles until upgrade and credential rotation complete.
• Enable log redaction filters at the log shipper to mask ://user:password@ patterns as a defense-in-depth control.

# Recommended airflow.cfg configuration after upgrade
[opensearch]
host = https://search.example.com:9200
username = {{ var.value.opensearch_user }}
password = {{ var.value.opensearch_password }}

[secrets]
backend = airflow.providers.hashicorp.secrets.vault.VaultBackend
backend_kwargs = {"connections_path": "connections", "variables_path": "variables", "mount_point": "airflow", "url": "https://vault.example.com"}