CVE-2026-42526 Details
Description
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.
A vulnerability exists in the AWS Secrets Manager and SSM Parameter Store backends of the Apache Airflow Amazon provider, affecting versions prior to 9.28.0. The issue arises from the team-scoping logic, which could incorrectly resolve a connection ID containing a slash to the same path as another team's secret when the caller lacked team context. This flaw allowed a privileged caller without team context to access another team's secret by crafting a conflicting connection ID. The vulnerability impacts only the experimental multi-tenant teams feature.
Users are advised to upgrade to Apache Airflow Amazon provider version 9.28.0 or later, which addresses this vulnerability by changing the team-scope separator to double hyphens and rejecting team-shaped connection IDs when team context is not present.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/19/36 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/65703 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-amazon | < 9.28.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 2, 2026 | Reanalysis | [email protected] |
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |
| May 19, 2026 | CVE Modified | CVE |