CVE-2026-42526

mediumpriority · track · 0OT risk · elevatedEPSS 0.004 · 35 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (35th) EPSS

CVSS 5.3 · medium

Is it mine?

5 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 1.6 · impact 3.6

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-863USCWE-863US

affected products (5)

Products and version ranges known to be affected.

Apache Airflow Amazon provider <9.28.0all versionscert_bundDE
Apache Airflow≤ Amazon provider <9.28.0cert_bundDE
Apache Software Foundation Apache Airflow Amazon provider0 → 9.28.0enisa_euvdEU
apache apache-airflow-providers-amazon< 9.28.0nvdUScpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*
PyPI apache-airflow-providers-amazon< 9.28.0osvUSpkg:pypi/apache-airflow-providers-amazon

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1595Apache Airflow: Mehrere SchwachstellenDeutsch2026-05-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.
GHSA-g9qc-qf28-hhqxApache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends2026-05-19ghsa · osvUS
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.
PYSEC-2026-5952026-05-19vendor · osvUS
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2026-05-19modified 2026-07-24

references (7)

External citations — patches, advisories, analysis.

https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/index.htmlPatchcnnvd
https://nvd.nist.gov/vuln/detail/CVE-2026-42526 cnnvd
https://github.com/apache/airflow/pull/65703 enisa_euvd
https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn enisa_euvd
http://www.openwall.com/lists/oss-security/2026/05/19/36Mailing ListThird Party Advisorynvd
https://github.com/apache/airflow/pull/65703Issue TrackingPatchnvd
https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtynMailing ListVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan