CVE-2026-41018 Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL
Attackers with task-log read access can harvest Elasticsearch credentials leaked in logs when the host URL embeds them.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41018?
CVE-2026-41018 is a medium-severity vulnerability in Apache Airflow Providers Elasticsearch, published on 11 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:[email protected]:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.
Weakness: CWE-532
Which versions are affected by CVE-2026-41018?
3 open source packages ship an affected version, including apache-airflow-providers-elasticsearch. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow-providers-elasticsearch PyPI | All versions | 6.5.3 |
apache-airflow-providers-elasticsearch PyPI | All versions | 6.5.3 |
apache-airflow-providers-elasticsearch PyPI | All versions | 6.5.3 |
Products include Apache Apache-Airflow-Providers-Elasticsearch.
How do I fix CVE-2026-41018?
Upgrade apache-airflow-providers-elasticsearch to 6.5.3 or later.
Is CVE-2026-41018 being exploited?
There is no known exploitation of CVE-2026-41018 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-ZX08511, ECHO-ab2f-d44e-ab00, GHSA-g3jr-4jrm-jvqv, MINI-gwj8-7xhj-jrp4, MINI-q8r3-w7vw-c2wr, PYSEC-2026-22 and 1 more.