CVE-2026-41018
The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — i…
Published May 11, 2026 · updated Jun 17, 2026 · apache apache-airflow-providers-elasticsearch
The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the URL.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 11, 2026 · NIST NVD
Detected
The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend ra
Jun 17, 2026 · NIST NVD
Updated
The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend ra
Affected
- cpe apache/apache-airflow-providers-elasticsearchversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41018
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41018
The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could
nvd.nist.gov