Skip to content
Threat Feed

Product

Airflow Providers OpenSearch (< 1.9.1)

1 brief RSS
low advisory

Apache Airflow OpenSearch Provider Credentials Leak via Task Logs (CVE-2026-43826)

The OpenSearch logging provider in Apache Airflow Providers OpenSearch versions before 1.9.1 wrote host URLs containing embedded credentials into task logs, potentially exposing them to unauthorized users with task-log read permission (CVE-2026-43826).

Airflow Providers OpenSearch credential-leak airflow opensearch
2r