CVE-2026-30912

Apache Airflow: Exposing stack trace in case of constraint error

State: Published
Severity: 7.5 High
Published: Apr 18, 2026
Updated: Apr 20, 2026
Reserved: Mar 7, 2026

Description

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

Product	Versions
Apache AirflowApache Software Foundation	before 3.2.0Affected

References

https://github.com/apache/airflow/pull/63028patch
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9vendor-advisory
http://www.openwall.com/lists/oss-security/2026/04/17/5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.