affected:
- package:
    ecosystem: PyPI
    name: apache-airflow-providers-opensearch
    purl: pkg:pypi/apache-airflow-providers-opensearch
  ranges:
  - events:
    - introduced: '0'
    - fixed: 1.9.1
    type: ECOSYSTEM
  versions:
  - 1.0.0
  - 1.0.0rc1
  - 1.1.0
  - 1.1.0rc1
  - 1.1.1
  - 1.1.1rc1
  - 1.1.2
  - 1.1.2rc1
  - 1.2.0
  - 1.2.0rc1
  - 1.2.1
  - 1.2.1rc1
  - 1.3.0
  - 1.3.0rc1
  - 1.4.0
  - 1.4.0rc1
  - 1.5.0
  - 1.5.0rc1
  - 1.6.0
  - 1.6.0rc1
  - 1.6.0rc2
  - 1.6.1
  - 1.6.1rc1
  - 1.6.2
  - 1.6.2rc1
  - 1.6.3
  - 1.6.3rc1
  - 1.7.0
  - 1.7.0rc1
  - 1.7.1
  - 1.7.1rc1
  - 1.7.2
  - 1.7.2rc1
  - 1.7.3
  - 1.7.3rc1
  - 1.7.4
  - 1.7.4rc1
  - 1.7.5
  - 1.7.5rc1
  - 1.8.0
  - 1.8.0rc1
  - 1.8.1
  - 1.8.1rc1
  - 1.8.2
  - 1.8.2rc1
  - 1.8.3
  - 1.8.3rc1
  - 1.8.4
  - 1.8.4rc1
  - 1.8.5
  - 1.8.5rc1
  - 1.9.0
  - 1.9.0rc1
  - 1.9.1rc1
aliases:
- CVE-2026-43826
- GHSA-xccp-97wp-3gjg
details: "The OpenSearch logging provider, when configured with a `host` URL that
  embeds credentials (for example `https://user:password@server.example.com:9200`),
  wrote the full host URL — including the embedded credentials — into task logs. Any
  user with task-log read permission could harvest the backend credentials. Users
  are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and,
  as a defense-in-depth measure, configure the backend credentials via a secret backend
  rather than embedding them in the `[opensearch] host` URL."
id: PYSEC-2026-23
modified: '2026-05-20T09:18:52.020715Z'
published: '2026-05-11T09:16:26.143Z'
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2026/05/10/2
- type: ADVISORY
  url: https://lists.apache.org/thread/bxsrqx1vwssovnwnrvgh9xcosptmf73y
- type: FIX
  url: https://github.com/apache/airflow/pull/65509
- type: ADVISORY
  url: https://github.com/advisories/GHSA-xccp-97wp-3gjg
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3