{"id":"CVE-2026-41018","aliases":["EUVD-2026-29040","GHSA-g3jr-4jrm-jvqv","PYSEC-2026-22","UBUNTU-CVE-2026-41018"],"status":"published","title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.0041,"percentile":0.35537,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2026-05-11T08:21:47Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"PyPI","package":"apache-airflow-providers-elasticsearch","fixed_in":["6.5.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow-providers-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0rc1","1.0.1","1.0.1rc1","1.0.2","1.0.2rc1","1.0.3","1.0.3rc1","1.0.4","1.0.4rc1","2.0.0","2.0.0rc1","2.0.1","2.0.1rc1","2.0.2","2.0.2rc1","2.0.2rc2","2.0.3","2.0.3rc1","2.1.0","2.1.0rc1","2.2.0","2.2.0rc3","3.0.0","3.0.0rc1","3.0.1","3.0.1rc1","3.0.2","3.0.2rc1","3.0.3","3.0.3rc1","4.0.0","4.0.0rc1","4.0.0rc2","4.1.0","4.1.0rc1","4.2.0","4.2.0rc1","4.2.0rc2","4.2.0rc3","4.2.1","4.2.1rc1","4.3.0","4.3.0rc1","4.3.1","4.3.1rc2","4.3.1rc3","4.3.2","4.3.2rc1","4.3.2rc2","4.3.3","4.3.3rc1","4.4.0","4.4.0rc1","4.5.0","4.5.0rc1","4.5.0rc2","4.5.1","4.5.1rc1","5.0.0","5.0.0rc1","5.0.0rc2","5.0.0rc3","5.0.1","5.0.1rc1","5.0.2","5.0.2rc1","5.1.0","5.1.0rc1","5.1.1","5.1.1rc1","5.2.0","5.2.0rc1","5.3.0","5.3.0rc1","5.3.1","5.3.1rc1","5.3.2","5.3.2rc1","5.3.3","5.3.3rc1","5.3.4","5.3.4rc1","5.4.0","5.4.0rc1","5.4.0rc2","5.4.1","5.4.1rc1","5.4.2","5.4.2rc1","5.5.0","5.5.0rc1","5.5.1","5.5.1rc1","5.5.2","5.5.2rc1","5.5.3","5.5.3rc1","6.0.0","6.0.0rc1","6.0.0rc2","6.1.0","6.2.0","6.2.0rc1","6.2.1","6.2.1rc1","6.2.2","6.2.2rc1","6.3.0","6.3.0rc1","6.3.1","6.3.1rc1","6.3.2","6.3.2rc1","6.3.3","6.3.3rc1","6.3.4","6.3.4rc1","6.3.5","6.3.5rc1","6.4.0","6.4.0rc1","6.4.1","6.4.1rc1","6.4.2","6.4.2rc1","6.4.3","6.4.3rc1","6.4.4","6.4.4rc1","6.5.0","6.5.0rc1","6.5.0rc2","6.5.0rc3","6.5.1","6.5.1rc1","6.5.2","6.5.2rc1","6.5.3rc1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0rc1","1.0.1","1.0.1rc1","1.0.2","1.0.2rc1","1.0.3","1.0.3rc1","1.0.4","1.0.4rc1","2.0.0","2.0.0rc1","2.0.1","2.0.1rc1","2.0.2","2.0.2rc1","2.0.2rc2","2.0.3","2.0.3rc1","2.1.0","2.1.0rc1","2.2.0","2.2.0rc3","3.0.0","3.0.0rc1","3.0.1","3.0.1rc1","3.0.2","3.0.2rc1","3.0.3","3.0.3rc1","4.0.0","4.0.0rc1","4.0.0rc2","4.1.0","4.1.0rc1","4.2.0","4.2.0rc1","4.2.0rc2","4.2.0rc3","4.2.1","4.2.1rc1","4.3.0","4.3.0rc1","4.3.1","4.3.1rc2","4.3.1rc3","4.3.2","4.3.2rc1","4.3.2rc2","4.3.3","4.3.3rc1","4.4.0","4.4.0rc1","4.5.0","4.5.0rc1","4.5.0rc2","4.5.1","4.5.1rc1","5.0.0","5.0.0rc1","5.0.0rc2","5.0.0rc3","5.0.1","5.0.1rc1","5.0.2","5.0.2rc1","5.1.0","5.1.0rc1","5.1.1","5.1.1rc1","5.2.0","5.2.0rc1","5.3.0","5.3.0rc1","5.3.1","5.3.1rc1","5.3.2","5.3.2rc1","5.3.3","5.3.3rc1","5.3.4","5.3.4rc1","5.4.0","5.4.0rc1","5.4.0rc2","5.4.1","5.4.1rc1","5.4.2","5.4.2rc1","5.5.0","5.5.0rc1","5.5.1","5.5.1rc1","5.5.2","5.5.2rc1","5.5.3","5.5.3rc1","6.0.0","6.0.0rc1","6.0.0rc2","6.1.0","6.2.0","6.2.0rc1","6.2.1","6.2.1rc1","6.2.2","6.2.2rc1","6.3.0","6.3.0rc1","6.3.1","6.3.1rc1","6.3.2","6.3.2rc1","6.3.3","6.3.3rc1","6.3.4","6.3.4rc1","6.3.5","6.3.5rc1","6.4.0","6.4.0rc1","6.4.1","6.4.1rc1","6.4.2","6.4.2rc1","6.4.3","6.4.3rc1","6.4.4","6.4.4rc1","6.5.0","6.5.0rc1","6.5.0rc2","6.5.0rc3","6.5.1","6.5.1rc1","6.5.2","6.5.2rc1","6.5.3rc1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2+dfsg-1","1.7.3+dfsg-1","1.7.3+dfsg-2","1.7.3+dfsg-3"]}],"products":[{"vendor":"apache","product":"apache-airflow-providers-elasticsearch"},{"vendor":"apache software foundation","product":"apache airflow providers elasticsearch"}],"references":[{"url":"https://github.com/apache/airflow/pull/65349","tags":["patch","Issue Tracking","Patch","fix","web","report"]},{"url":"https://lists.apache.org/thread/wz5l58drprmwlv6jxnq466x24jqbbhp7","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/10/3","tags":["Mailing List","Third Party Advisory","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41018","tags":["advisory"]},{"url":"https://github.com/apache/airflow/commit/f9244064016a8db45277efb0c24808e663b233f3","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-elasticsearch/PYSEC-2026-22.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g3jr-4jrm-jvqv","tags":["advisory"]},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41018.json","tags":["advisory"]},{"url":"https://github.com/apache/airflow","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-41018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41018","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41018","title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T08:21:47.722Z","modified":"2026-05-11T12:59:39.211Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-29040","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T08:21:47Z","modified":"2026-05-11T12:59:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:13.690762Z"}],"ghsa":[{"id":"GHSA-g3jr-4jrm-jvqv","title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T09:30:32Z","modified":"2026-06-05T14:14:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-41018","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T09:16:25.99Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-41018","title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T08:21:47.722Z","modified":"2026-10-28T02:30:34.900929256Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-g3jr-4jrm-jvqv","title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T09:30:32Z","modified":"2026-09-10T03:50:46.914455844Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"PYSEC-2026-22","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T09:16:25.99Z","modified":"2026-06-10T17:00:05.499962159Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-41018","description":"The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.","status":"published","published":"2026-05-11T09:16:00Z","modified":"2026-05-14T14:43:18.504076Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"}]}}