CVE-2026-45192 is an information exposure vulnerability in Apache Airflow affecting the GET /api/v2/connections/{connection_id} REST API endpoint. Authenticated users with Connection-read permission could retrieve plaintext secrets stored in the Connection's extra JSON blob under field names not included in the redaction allowlist (DEFAULT_SENSITIVE_FIELDS). For example, Slack-provider credential fields were exposed. This vulnerability impacts deployments that store credentials inline in the extra field and allow multiple users Connection-read access. The issue is resolved in Apache Airflow 3.2.2 and later versions. As an additional mitigation, storing sensitive credentials in a secret backend rather than inline in the extra field is recommended.

An authenticated user with Connection-read permission can access sensitive credential information in plaintext that should have been redacted, potentially leading to unauthorized disclosure of secrets such as Slack credentials. This could compromise confidentiality of stored credentials but does not affect integrity or availability. The impact is limited to deployments that store credentials in the extra field and grant read access to multiple users.

Upgrade Apache Airflow to version 3.2.2 or later, where this vulnerability is fixed. Additionally, as a defense-in-depth measure, store sensitive credential values in a secret backend instead of embedding them in the Connection's extra JSON field. No vendor advisory explicitly states otherwise, so these are the recommended actions.