CVE-2026-30912
Published: 18 April 2026
Summary
CVE-2026-30912 is a high-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Apache Airflow. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-30912 is a vulnerability in Apache Airflow that causes SQL error exception and stack traces to be exposed via the API, even when the "api/expose_stack_traces" configuration is set to false. This improper handling of error information affects Apache Airflow versions prior to 3.2.0 and is classified under CWE-668, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
Remote attackers require only network access and face low complexity with no privileges or user interaction needed to exploit this issue. By triggering SQL errors in the API, unauthenticated adversaries can obtain stack traces, potentially revealing sensitive system details such as database structures, paths, or other internal information that aids further attacks.
Advisories recommend upgrading to Apache Airflow 3.2.0, which resolves the exposure. Relevant references include the fixing pull request at https://github.com/apache/airflow/pull/63028, an Apache mailing list announcement at https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9, and an OSS-security mailing list post at http://www.openwall.com/lists/oss-security/2026/04/17/5.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23662
Vulnerability details
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which…
more
fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing Apache Airflow API enables remote unauthenticated exploitation for stack trace disclosure (T1190); resulting exposure of paths, DB structures and internals directly supports System Information Discovery (T1082).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-11 requires systems to handle errors and exceptions without compromising information security or revealing details that assist adversaries, directly preventing stack trace exposure in API error responses.
SI-2 mandates timely remediation of identified flaws, directly addressing this CVE by requiring upgrades to Apache Airflow 3.2.0 to eliminate the exposure.
SI-15 requires filtering of output to block sensitive information, mitigating potential leakage of stack traces and system details in API responses.