The Apache Airflow Providers Elasticsearch logging provider, when configured with a host URL containing embedded credentials (e.g., https://user:password@server.example.com:9200), logs the entire URL including credentials into task logs. This results in sensitive information leakage (CWE-532: Insertion of Sensitive Information into Log File). The vulnerability affects all versions prior to 6.5.3. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges to read logs, no user interaction, unchanged scope, and high confidentiality impact.

Any user with permission to read task logs can obtain backend Elasticsearch credentials embedded in the host URL, potentially leading to unauthorized access to Elasticsearch resources. The confidentiality of sensitive credentials is compromised, but integrity and availability are not directly affected.

Users should upgrade to apache-airflow-providers-elasticsearch version 6.5.3 or later where this issue is fixed. Additionally, as a defense-in-depth measure, credentials should not be embedded directly in the Elasticsearch host URL but configured via a secret backend. Patch status is not explicitly confirmed in the advisory, but the upgrade recommendation indicates a fix is available in 6.5.3+.