The OpenSearch logging provider in Apache Airflow Providers OpenSearch, when configured with a host URL embedding credentials (e.g., https://user:password@server.example.com:9200), writes the entire URL including credentials into task logs. This exposes sensitive backend credentials to any user with permission to read task logs. The issue is identified as CWE-532, indicating sensitive information leakage via logs. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, and requires privileges to read logs but no user interaction. The recommended remediation is upgrading to version 1.9.1 or later and using secret backends for credentials instead of embedding them in URLs.

The vulnerability allows disclosure of sensitive backend credentials to any user who can read task logs, potentially leading to unauthorized access to backend services. There is no direct impact on integrity or availability. The exposure is limited to users with task-log read permissions, which may vary depending on deployment configurations.

Upgrade Apache Airflow Providers OpenSearch to version 1.9.1 or later where this issue is fixed. Additionally, configure backend credentials using a secret backend rather than embedding them in the host URL to reduce risk. Since no official patch link or vendor advisory is provided, check the Apache Airflow Providers OpenSearch release notes or official documentation for confirmation and further guidance. Patch status is not yet confirmed in the provided data; verify with vendor sources.