Title: Apache Airflow de Apache Software Foundation, Description: Un error en el endpoint de la API REST GET '/api/v2/connections/{connection_id}' en Apache Airflow permitió a un usuario autenticado de UI/API con permiso de lectura de Conexión recuperar secretos almacenados en un blob JSON  extra  de una Conexión bajo nombres de campo no presentes en la lista de permitidos de redacción ( DEFAULT_SENSITIVE_FIELDS ) — por ejemplo, los nombres de campo de credenciales oficiales del proveedor de Slack se devolvieron en texto plano. Afecta a las implementaciones que almacenan credenciales en blobs  extra  de Conexión y otorgan acceso de lectura de Conexión a múltiples usuarios. Se aconseja a los usuarios actualizar a  apache-airflow  3.2.2 o posterior. Como una mitigación de defensa en profundidad, los operadores de implementación pueden almacenar valores de credenciales sensibles en un backend de secretos en lugar de incrustados en el campo  extra  de la Conexión.

{"timestamp":"2026-06-01T12:52:50.106367Z","id":"CVE-2026-45192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Apache Software Foundation","product":"Apache Airflow","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"apache-airflow","versions":[{"version":"0","lessThan":"3.2.2","versionType":"semver","status":"affected"}]}]

OR
          *cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* versions up to (excluding) 3.2.2

Apache Software Foundation: https://github.com/apache/airflow/pull/66673 Types: Issue Tracking, Patch

Apache Software Foundation: https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd Types: Mailing List, Vendor Advisory

CVE: http://www.openwall.com/lists/oss-security/2026/06/01/3 Types: Mailing List, Third Party Advisory

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

http://www.openwall.com/lists/oss-security/2026/06/01/3

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read access to multiple users. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can store sensitive credential values in a secret-backend rather than inlined into the Connection's `extra` field.

CWE-200

https://github.com/apache/airflow/pull/66673

https://lists.apache.org/thread/r2q93dg2wp5h9sd9vh6y4y5ljqd9crdd