CVE-2026-43826
The OpenSearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into…
Published May 11, 2026 · updated Jun 17, 2026 · apache apache-airflow-providers-opensearch
The OpenSearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the URL.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 11, 2026 · NIST NVD
Detected
The OpenSearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rathe
Jun 17, 2026 · NIST NVD
Updated
The OpenSearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rathe
Affected
- cpe apache/apache-airflow-providers-opensearchversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-43826
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-43826
The OpenSearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could ha
nvd.nist.gov