CVE-2026-30912: Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

April 18, 2026 (updated June 5, 2026)

In case of SQL errors, exception/stack trace of errors was exposed in API even if “api/expose_stack_traces” was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

References

github.com/advisories/GHSA-w7cf-2pmc-5m4c
github.com/apache/airflow/pull/63028
github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-18.yaml
lists.apache.org/thread/tp6kz1hnfb3zsrrtg19myo8x5x80w8r9
nvd.nist.gov/vuln/detail/CVE-2026-30912

Code Behaviors & Features

Detect and mitigate CVE-2026-30912 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →