MEDIUM5.3

PYSEC-2026-2361

Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

Quick fix

PYSEC-2026-2361 — apache-airflow-core: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow-core>=3.2.0'

Details

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow-core

Introduced in: 0Fixed in: 3.2.0

Fixpip install --upgrade 'apache-airflow-core>=3.2.0'

References

https://nvd.nist.gov/vuln/detail/CVE-2026-30912[ADVISORY]
https://github.com/apache/airflow/pull/63028[WEB]
https://github.com/apache/airflow[WEB]
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml[WEB]
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9[WEB]
http://www.openwall.com/lists/oss-security/2026/04/17/5[WEB]
https://pypi.org/project/apache-airflow-core[PACKAGE]
https://github.com/advisories/GHSA-w7cf-2pmc-5m4c[ADVISORY]