CVE-2026-43826

The OpenSearch logging provider in Apache Airflow is vulnerable to credential leakage when the host URL includes embedded credentials (e.g., https://user:[email protected]:9200). The provider writes the full URL, including the embedded credentials , into task logs , allowing any user wi...