216.73.217.98

CVE-2026-41018

· Published 11/05/2026 09:16 · Modified 12/05/2026 14:13

Labels: CVE-2026-41018 2026-05-11CVE-2026-41018CWE-532[email protected]

Essential information

Published
11/05/2026 09:16
Modified
12/05/2026 14:13
Author
Creator
CVSS
6.5 MEDIUM (v3.1)
CISA KEV
No
CWE
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS metrics

Description

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.

NVD status

Status
Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
apache / apache-airflow-providers-elasticsearch cpe:2.3:a:apache:apache-airflow-providers-elasticsearch:6.5.3:*:*:*:*:*:*:*
apache / apache-airflow-providers-elasticsearch cpe:2.3:a:apache:apache-airflow-providers-elasticsearch:*:*:*:*:*:*:*:*

References