{"id":"CVE-2026-43826","aliases":["EUVD-2026-29042","GHSA-xccp-97wp-3gjg","PYSEC-2026-23","UBUNTU-CVE-2026-43826"],"status":"published","title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0041,"percentile":0.3573,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2026-05-11T08:21:08Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"PyPI","package":"apache-airflow-providers-opensearch","fixed_in":["1.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow-providers-opensearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-opensearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}],"versions":["1.0.0","1.0.0rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.1.2","1.1.2rc1","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.3.0","1.3.0rc1","1.4.0","1.4.0rc1","1.5.0","1.5.0rc1","1.6.0","1.6.0rc1","1.6.0rc2","1.6.1","1.6.1rc1","1.6.2","1.6.2rc1","1.6.3","1.6.3rc1","1.7.0","1.7.0rc1","1.7.1","1.7.1rc1","1.7.2","1.7.2rc1","1.7.3","1.7.3rc1","1.7.4","1.7.4rc1","1.7.5","1.7.5rc1","1.8.0","1.8.0rc1","1.8.1","1.8.1rc1","1.8.2","1.8.2rc1","1.8.3","1.8.3rc1","1.8.4","1.8.4rc1","1.8.5","1.8.5rc1","1.9.0","1.9.0rc1","1.9.1rc1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-opensearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1"}]}],"versions":["1.0.0","1.0.0rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.1.2","1.1.2rc1","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.3.0","1.3.0rc1","1.4.0","1.4.0rc1","1.5.0","1.5.0rc1","1.6.0","1.6.0rc1","1.6.0rc2","1.6.1","1.6.1rc1","1.6.2","1.6.2rc1","1.6.3","1.6.3rc1","1.7.0","1.7.0rc1","1.7.1","1.7.1rc1","1.7.2","1.7.2rc1","1.7.3","1.7.3rc1","1.7.4","1.7.4rc1","1.7.5","1.7.5rc1","1.8.0","1.8.0rc1","1.8.1","1.8.1rc1","1.8.2","1.8.2rc1","1.8.3","1.8.3rc1","1.8.4","1.8.4rc1","1.8.5","1.8.5rc1","1.9.0","1.9.0rc1","1.9.1rc1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"opensearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg-2"]}],"products":[{"vendor":"apache","product":"apache-airflow-providers-opensearch"},{"vendor":"apache software foundation","product":"apache airflow providers opensearch"}],"references":[{"url":"https://github.com/apache/airflow/pull/65509","tags":["patch","Issue Tracking","Patch","fix","web","report"]},{"url":"https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/10/2","tags":["Mailing List","Third Party Advisory","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43826","tags":["advisory"]},{"url":"https://github.com/apache/airflow/commit/6a6b6ff409fb48c28bd63482828632a3c5a5bb93","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-opensearch/PYSEC-2026-23.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xccp-97wp-3gjg","tags":["advisory"]},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43826.json","tags":["advisory"]},{"url":"https://github.com/apache/airflow","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-43826","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43826","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-43826","title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T08:21:08.702Z","modified":"2026-05-11T13:02:08.325Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-29042","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T08:21:08Z","modified":"2026-05-11T13:02:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:13.690762Z"}],"ghsa":[{"id":"GHSA-xccp-97wp-3gjg","title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T09:30:32Z","modified":"2026-06-05T14:15:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-43826","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T09:16:26.143Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-43826","title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T08:21:08.702Z","modified":"2026-10-28T02:30:57.512890142Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-xccp-97wp-3gjg","title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T09:30:32Z","modified":"2026-06-05T14:30:12.723664332Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"PYSEC-2026-23","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T09:16:26.143Z","modified":"2026-06-10T17:00:05.436540126Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-43826","description":"The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.","status":"published","published":"2026-05-11T09:16:00Z","modified":"2026-05-14T14:53:42.644355Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:22.075798Z"}]}}