Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL

中 6.5CVE-2026-41018 · GHSA-g3jr-4jrm-jvqv · PYSEC-2026-22 · 11/05/2026 公開 · 26/10/2026 更新

要点

CVE-2026-41018 は apache-airflow-providers-elasticsearch, apache-airflow-providers-elasticsearch (apache) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.41%（全脆弱性の 35.4% より高い）。
対処：6.5.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
apache-airflow-providers-elasticsearch PyPI	`< 6.5.3`	`6.5.3`
apache-airflow-providers-elasticsearch apache	`< 6.5.3`	`6.5.3`

概要

The Elasticsearch logging provider, when configured with a host URL that embeds credentials (for example https://user:[email protected]:9200), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to apache-airflow-providers-elasticsearch 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the [elasticsearch] host URL.

NVD の説明

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.