The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example
    `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded
    credentials — into task logs. Any user with task-log read permission could harvest the backend
    credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and,
    as a defense-in-depth measure, configure the backend credentials via a secret backend rather than
    embedding them in the `[elasticsearch] host` URL. (CVE-2026-41018)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example     `https://user:password@server.example.com:9200`), wrote the full host URL  including the embedded     credentials  into task logs. Any user with task-log read permission could harvest the backend     credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and,     as a defense-in-depth measure, configure the backend credentials via a secret backend rather than     embedding them in the `[elasticsearch] host` URL. (CVE-2026-41018)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458772	Echo: apache-airflow-providers-elasticsearch: security update to 6.5.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458772	Echo: apache-airflow-providers-elasticsearch: security update to 6.5.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
441996	SCA: security update for apache-airflow-providers-elasticsearch (GHSA-g3jr-4jrm-jvqv)	Tenable Cloud Security	SCA Checks	Local	medium
441996	SCA: security update for apache-airflow-providers-elasticsearch (GHSA-g3jr-4jrm-jvqv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
314740	Linux Distros Unpatched Vulnerability : CVE-2026-41018	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-41018

medium

Tenable Plugins

medium

medium

medium

medium

medium