Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tpjn-4kru-vucv
Vulnerability ID VCID-tpjn-4kru-vucv
Aliases BIT-airflow-2026-30912
CVE-2026-30912
GHSA-w7cf-2pmc-5m4c
PYSEC-2026-18
Summary In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-668 Exposure of Resource to Wrong Sphere
System Score Found at
epss 0.00095 https://api.first.org/data/v1/epss?cve=CVE-2026-30912
cvssv3.1 5.3 https://github.com/apache/airflow
generic_textual MODERATE https://github.com/apache/airflow
cvssv3.1 5.3 https://github.com/apache/airflow/pull/63028
cvssv3.1 7.5 https://github.com/apache/airflow/pull/63028
generic_textual MODERATE https://github.com/apache/airflow/pull/63028
ssvc Track https://github.com/apache/airflow/pull/63028
cvssv3.1 5.3 https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
cvssv3.1 7.5 https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
generic_textual MODERATE https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
ssvc Track https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-30912
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-30912
cvssv3.1 5.3 http://www.openwall.com/lists/oss-security/2026/04/17/5
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2026/04/17/5
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2026/04/17/5
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-30912
https://github.com/apache/airflow
https://github.com/apache/airflow/pull/63028
https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
https://nvd.nist.gov/vuln/detail/CVE-2026-30912
http://www.openwall.com/lists/oss-security/2026/04/17/5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/apache/airflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/apache/airflow/pull/63028
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow/pull/63028
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-20T15:56:44Z/ Found at https://github.com/apache/airflow/pull/63028
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-20T15:56:44Z/ Found at https://lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-30912
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2026/04/17/5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2026/04/17/5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.26413
EPSS Score 0.00095
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:38:13.844951+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-18.yaml 38.6.0