Vulnerability-Lookup

CVE-2026-42526 (GCVE-0-2026-42526)

Vulnerability from cvelistv5 – Published: 2026-05-19 19:17 – Updated: 2026-05-19 19:53

Title

Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

Summary

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-863 - Incorrect Authorization

Assigner

apache

References

3 references

URL	Tags
https://github.com/apache/airflow/pull/65703	patch
https://lists.apache.org/thread/0092sz5g520d3qqjb…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Airflow Amazon provider	Affected: 0 , < 9.28.0 (semver)

Credits

Justin Pakzad

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-19T19:34:02.809Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/19/36"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T19:53:21.498429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T19:53:24.129Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-amazon",
          "product": "Apache Airflow Amazon provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "9.28.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Justin Pakzad"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\u0026quot;my_team/conn\u0026quot;`) to the same path as another team\u0026#x27;s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0026#x27;s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue."
            }
          ],
          "value": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T19:17:51.565Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/65703"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends",
      "x_generator": {
        "engine": "airflow-s/generate_cve_json.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-42526",
    "datePublished": "2026-05-19T19:17:51.565Z",
    "dateReserved": "2026-04-28T10:28:10.377Z",
    "dateUpdated": "2026-05-19T19:53:24.129Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42526",
      "date": "2026-07-24",
      "epss": "0.00413",
      "percentile": "0.33808"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42526\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-05-19T20:16:19.163\",\"lastModified\":\"2026-07-24T09:10:00.153\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\\\"my_team/conn\\\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.\"},{\"lang\":\"es\",\"value\":\"En los backends de secretos de AWS Secrets Manager y SSM Parameter Store de \u0027apache-airflow-providers-amazon\u0027 anteriores a la versi\u00f3n 9.28.0, la l\u00f3gica de alcance de equipo podr\u00eda resolver un \u0027conn_id\u0027 que contuviera un  /  (por ejemplo,  my_team/conn ) a la misma ruta que un secreto con alcance de equipo de otro equipo cuando el llamador no ten\u00eda contexto de equipo. Un llamador privilegiado sin contexto de equipo podr\u00eda, por lo tanto, recuperar el secreto de otro equipo al crear un \u0027conn_id\u0027 en colisi\u00f3n. Corregido en la versi\u00f3n 9.28.0 al cambiar el separador de alcance de equipo a  --  y rechazando los \u0027conn_id\u0027 con forma de equipo cuando el contexto de equipo est\u00e1 ausente. Afecta solo a la caracter\u00edstica experimental de equipos multi-inquilino. Se recomienda a los usuarios actualizar a \u0027apache-airflow-providers-amazon\u0027 9.28.0, que corrige el problema.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Airflow Amazon provider\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pypi.python.org\",\"packageName\":\"apache-airflow-providers-amazon\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"9.28.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-19T19:53:21.498429Z\",\"id\":\"CVE-2026-42526\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.28.0\",\"matchCriteriaId\":\"CC5DFF6C-DFC7-465A-80C6-108810DE093E\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/65703\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/05/19/36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:46:34+00:00",
      "cve": "CVE-2026-42526",
      "id": "CVE-2026-42526",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42526.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/05/19/36\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-05-19T19:34:02.809Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42526\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-19T19:53:21.498429Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-19T19:53:15.062Z\"}}], \"cna\": {\"title\": \"Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Justin Pakzad\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow Amazon provider\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"9.28.0\", \"versionType\": \"semver\"}], \"packageName\": \"apache-airflow-providers-amazon\", \"collectionURL\": \"https://pypi.python.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/65703\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"airflow-s/generate_cve_json.py\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\\\"my_team/conn\\\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\u0026quot;my_team/conn\u0026quot;`) to the same path as another team\u0026#x27;s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0026#x27;s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-05-19T19:17:51.565Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42526\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-19T19:53:24.129Z\", \"dateReserved\": \"2026-04-28T10:28:10.377Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-05-19T19:17:51.565Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42526

Vulnerability from fkie_nvd - Published: 2026-05-19 20:16 - Updated: 2026-07-02 16:36

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security@apache.org	https://github.com/apache/airflow/pull/65703	Issue Tracking, Patch
security@apache.org	https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn	Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/05/19/36	Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	apache	apache-airflow-providers-amazon	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-amazon",
          "product": "Apache Airflow Amazon provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "9.28.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC5DFF6C-DFC7-465A-80C6-108810DE093E",
              "versionEndExcluding": "9.28.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue."
    }
  ],
  "id": "CVE-2026-42526",
  "lastModified": "2026-07-02T16:36:03.987",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42526",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-19T19:53:21.498429Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-19T20:16:19.163",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/apache/airflow/pull/65703"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/05/19/36"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-G9QC-QF28-HHQX

Vulnerability from github – Published: 2026-05-19 21:32 – Updated: 2026-06-05 16:37

Summary

Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

Details

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a / (e.g. "my_team/conn") to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to -- and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to apache-airflow-providers-amazon 9.28.0, which fixes the issue.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-amazon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.28.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42526"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T16:37:51Z",
    "nvd_published_at": "2026-05-19T20:16:19Z",
    "severity": "MODERATE"
  },
  "details": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.",
  "id": "GHSA-g9qc-qf28-hhqx",
  "modified": "2026-06-05T16:37:51Z",
  "published": "2026-05-19T21:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42526"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/65703"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/19/36"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends"
}

PYSEC-2026-595

Vulnerability from pysec - Published: 2026-05-19 20:16 - Updated: 2026-07-01 17:16

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Impacted products

Name	purl
apache-airflow-providers-amazon	pkg:pypi/apache-airflow-providers-amazon

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-amazon",
        "purl": "pkg:pypi/apache-airflow-providers-amazon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.28.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0",
        "1.0.0b1",
        "1.0.0b2",
        "1.0.0rc1",
        "1.1.0",
        "1.1.0rc1",
        "1.2.0",
        "1.2.0rc1",
        "1.3.0",
        "1.3.0rc1",
        "1.4.0",
        "1.4.0rc1",
        "2.0.0",
        "2.0.0rc1",
        "2.0.0rc2",
        "2.1.0",
        "2.1.0rc1",
        "2.1.0rc2",
        "2.2.0",
        "2.2.0rc1",
        "2.3.0",
        "2.3.0rc1",
        "2.3.0rc2",
        "2.4.0",
        "2.4.0rc1",
        "2.4.0rc2",
        "2.5.0",
        "2.5.0rc1",
        "2.6.0",
        "2.6.0rc1",
        "3.0.0",
        "3.0.0rc1",
        "3.0.0rc2",
        "3.1.0rc1",
        "3.1.1",
        "3.1.1rc1",
        "3.2.0",
        "3.2.0rc1",
        "3.3.0",
        "3.3.0rc1",
        "3.4.0",
        "3.4.0rc1",
        "4.0.0",
        "4.0.0rc1",
        "4.0.0rc2",
        "4.1.0",
        "4.1.0rc1",
        "5.0.0",
        "5.0.0rc1",
        "5.0.0rc2",
        "5.0.0rc3",
        "5.1.0",
        "5.1.0rc1",
        "6.0.0",
        "6.0.0rc1",
        "6.1.0",
        "6.1.0rc1",
        "6.2.0",
        "6.2.0rc2",
        "6.2.0rc3",
        "7.0.0",
        "7.0.0rc1",
        "7.0.0rc2",
        "7.1.0",
        "7.1.0rc1",
        "7.2.0",
        "7.2.0rc1",
        "7.2.1",
        "7.2.1rc1",
        "7.3.0",
        "7.3.0rc1",
        "7.4.0",
        "7.4.0rc1",
        "7.4.1",
        "7.4.1rc1",
        "8.0.0",
        "8.0.0rc1",
        "8.0.0rc2",
        "8.0.0rc3",
        "8.1.0",
        "8.1.0rc1",
        "8.1.0rc2",
        "8.10.0",
        "8.10.0rc1",
        "8.11.0",
        "8.11.0rc1",
        "8.12.0",
        "8.12.0rc1",
        "8.13.0",
        "8.13.0rc1",
        "8.14.0",
        "8.14.0rc1",
        "8.15.0",
        "8.15.0rc1",
        "8.16.0",
        "8.16.0rc1",
        "8.17.0",
        "8.17.0rc1",
        "8.17.0rc2",
        "8.18.0",
        "8.18.0rc1",
        "8.18.0rc2",
        "8.19.0",
        "8.19.0rc1",
        "8.2.0",
        "8.2.0rc1",
        "8.20.0",
        "8.20.0rc1",
        "8.21.0",
        "8.21.0rc1",
        "8.22.0",
        "8.22.0rc1",
        "8.23.0",
        "8.23.0rc1",
        "8.24.0",
        "8.24.0rc1",
        "8.24.0rc2",
        "8.25.0",
        "8.25.0rc1",
        "8.26.0",
        "8.26.0rc1",
        "8.26.0rc2",
        "8.27.0",
        "8.27.0rc1",
        "8.27.0rc2",
        "8.28.0",
        "8.28.0rc1",
        "8.29.0",
        "8.29.0rc1",
        "8.3.0",
        "8.3.0rc1",
        "8.3.0rc2",
        "8.3.0rc3",
        "8.3.0rc4",
        "8.3.1",
        "8.3.1rc1",
        "8.4.0",
        "8.4.0rc1",
        "8.5.0",
        "8.5.0rc1",
        "8.5.1",
        "8.5.1rc1",
        "8.6.0",
        "8.6.0rc1",
        "8.7.0",
        "8.7.0rc1",
        "8.7.1",
        "8.7.1rc1",
        "8.8.0",
        "8.8.0rc1",
        "8.9.0",
        "8.9.0rc1",
        "9.0.0",
        "9.0.0rc1",
        "9.1.0",
        "9.1.0rc1",
        "9.1.0rc2",
        "9.1.0rc3",
        "9.1.0rc4",
        "9.10.0",
        "9.10.0rc1",
        "9.11.0",
        "9.11.0rc1",
        "9.12.0",
        "9.12.0rc1",
        "9.13.0",
        "9.13.0rc1",
        "9.14.0",
        "9.14.0rc1",
        "9.15.0",
        "9.15.0rc1",
        "9.16.0",
        "9.16.0rc1",
        "9.17.0",
        "9.17.0rc1",
        "9.18.0",
        "9.18.0rc1",
        "9.18.0rc2",
        "9.18.1",
        "9.18.1rc1",
        "9.19.0",
        "9.19.0rc1",
        "9.2.0",
        "9.2.0rc1",
        "9.2.0rc2",
        "9.20.0",
        "9.20.0rc1",
        "9.21.0",
        "9.21.0rc1",
        "9.22.0",
        "9.22.0rc1",
        "9.22.0rc2",
        "9.22.0rc3",
        "9.23.0",
        "9.23.0rc1",
        "9.24.0",
        "9.24.0rc1",
        "9.25.0",
        "9.25.0rc1",
        "9.25.0rc2",
        "9.26.0",
        "9.26.0rc1",
        "9.27.0",
        "9.27.0rc1",
        "9.28.0rc1",
        "9.3.0",
        "9.4.0",
        "9.4.0rc1",
        "9.5.0",
        "9.5.0rc1",
        "9.5.0rc2",
        "9.5.0rc3",
        "9.6.0",
        "9.6.0rc1",
        "9.6.1",
        "9.6.1rc1",
        "9.7.0",
        "9.7.0rc1",
        "9.7.0rc2",
        "9.8.0",
        "9.8.0rc1",
        "9.9.0",
        "9.9.0rc1",
        "9.9.1rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42526",
    "GHSA-g9qc-qf28-hhqx"
  ],
  "details": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.",
  "id": "PYSEC-2026-595",
  "modified": "2026-07-01T17:16:01.306680Z",
  "published": "2026-05-19T20:16:19.163Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/19/36"
    },
    {
      "type": "ADVISORY",
      "url": "https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn"
    },
    {
      "type": "FIX",
      "url": "https://github.com/apache/airflow/pull/65703"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-g9qc-qf28-hhqx"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1595

Vulnerability from csaf_certbund - Published: 2026-05-19 22:00 - Updated: 2026-05-19 22:00

Summary

Apache Airflow: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2026-27173

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Apache Airflow CNCF Kubernetes provider <10.17.0 Apache / Airflow		CNCF Kubernetes provider <10.17.0

CVE-2026-42526

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Apache Airflow Amazon provider <9.28.0 Apache / Airflow		Amazon provider <9.28.0

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://seclists.org/oss-sec/2026/q2/607	external
https://seclists.org/oss-sec/2026/q2/608	external
https://www.cve.org/CVERecord?id=CVE-2026-27173	external
https://www.cve.org/CVERecord?id=CVE-2026-42526	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und \u00dcberwachung von Workflows.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1595 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1595.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1595 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1595"
      },
      {
        "category": "external",
        "summary": "OSS Security Mailing List vom 2026-05-19",
        "url": "https://seclists.org/oss-sec/2026/q2/607"
      },
      {
        "category": "external",
        "summary": "OSS Security Mailing List vom 2026-05-19",
        "url": "https://seclists.org/oss-sec/2026/q2/608"
      },
      {
        "category": "external",
        "summary": "CVERecord vom 2026-05-19",
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-27173"
      },
      {
        "category": "external",
        "summary": "CVERecord vom 2026-05-19",
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-42526"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Airflow: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-19T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-20T10:30:35.976+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1595",
      "initial_release_date": "2026-05-19T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-19T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "CNCF Kubernetes provider \u003c10.17.0",
                "product": {
                  "name": "Apache Airflow CNCF Kubernetes provider \u003c10.17.0",
                  "product_id": "T054352"
                }
              },
              {
                "category": "product_version",
                "name": "CNCF Kubernetes provider 10.17.0",
                "product": {
                  "name": "Apache Airflow CNCF Kubernetes provider 10.17.0",
                  "product_id": "T054352-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:airflow:cncf_kubernetes_provider__10.17.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Amazon provider \u003c9.28.0",
                "product": {
                  "name": "Apache Airflow Amazon provider \u003c9.28.0",
                  "product_id": "T054353"
                }
              },
              {
                "category": "product_version",
                "name": "Amazon provider 9.28.0",
                "product": {
                  "name": "Apache Airflow Amazon provider 9.28.0",
                  "product_id": "T054353-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:airflow:amazon_provider__9.28.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Airflow"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27173",
      "product_status": {
        "known_affected": [
          "T054352"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-27173"
    },
    {
      "cve": "CVE-2026-42526",
      "product_status": {
        "known_affected": [
          "T054353"
        ]
      },
      "release_date": "2026-05-19T22:00:00.000+00:00",
      "title": "CVE-2026-42526"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-42526 (GCVE-0-2026-42526)

FKIE_CVE-2026-42526

GHSA-G9QC-QF28-HHQX

PYSEC-2026-595

WID-SEC-W-2026-1595

Tags

Sightings

Nomenclature