The Elasticsearch logging provider incorrectly records the full host URL in task logs, even when that URL contains embedded credentials. A user with read access to task logs can obtain the Elasticsearch backend username and password. This is a direct out‑of‑band leakage of sensitive information and is identified as CWE-532.

The vulnerability affects the Apache Airflow Providers Elasticsearch package supplied by the Apache Software Foundation. Versions prior to 6.5.3 are vulnerable; users should upgrade to 6.5.3 or newer, which removes the automatic logging of embedded credentials.

Because the data is written to logs, an attacker only needs permission to view task logs to harvest the credentials. The exploit requires no special network access and can be performed by any privileged user within the Airflow environment, making it a high‑risk internal threat. EPSS is unavailable and the vulnerability is not listed in the CISA KEV catalog, but its impact remains significant due to credential exposure.