CVE-2026-45192

A bug in the GET /api/v2/connections/connectionid REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's extra JSON blob under field names not present in the redaction allowlist DEFAULTSENSITIVEFIELDS —...

CVE-2026-45192

creationtimestamp| type| source ---|---|--- 2026-06-01 05:38:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn7egkqk5j25 2026-06-01 11:06:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7wrkurec2b...