https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T03:02:36.844416+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-107474 CVE-2026-107474 — Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext 2026-11-11T03:02:36.858581+00:00

Affected: Apache Software Foundation Apache Airflow

The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.

Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.