In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In case of SQL errors, exception/stack trace of errors was exposed in API even if
    "api/expose_stack_traces" was set to false. That could lead to exposing additional information to
    potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
    (CVE-2026-30912)

The version of Apache Airflow installed on the remote host is prior to 3.2.0. It is, therefore, affected by multiple vulnerabilities, including:

  - DAG authors who normally should not be able to execute code in the webserver context can craft     an XCom payload causing the webserver to execute arbitrary code via deserialization.
    (CVE-2026-25917)

  - An example of BashOperator in the Airflow documentation suggested passing dag_run.conf in a way     that could cause unsanitized user input to be used to escalate privileges of a UI user and     execute code on a worker. (CVE-2026-30898)

  - A UI or API user with asset materialize permission could trigger DAGs they had no access to.
    This issue affects Apache Airflow 3.0.0 through 3.1.x. (CVE-2026-32228)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460295	Echo: apache-airflow-core: security update to 3.2.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
460295	Echo: apache-airflow-core: security update to 3.2.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
315213	Apache Airflow < 3.2.0 Multiple Vulnerabilities	Nessus	Misc.	Local	high
440725	SCA: security update for apache-airflow-core (GHSA-w7cf-2pmc-5m4c)	Tenable Cloud Security	SCA Checks	Local	high
440725	SCA: security update for apache-airflow-core (GHSA-w7cf-2pmc-5m4c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-30912

high

Tenable Plugins

high

high

high

high

high