CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/65703	Issue Tracking Patch
https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/19/36	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-19 20:16

Updated : 2026-07-24 09:10

NVD link : CVE-2026-42526

Mitre link : CVE-2026-42526

CVE.ORG link : CVE-2026-42526

JSON object : View

Products Affected

apache

apache-airflow-providers-amazon

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-42526", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42526", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T19:53:21.498429Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow Amazon provider", "versions": [{"status": "affected", "version": "0", "lessThan": "9.28.0", "versionType": "semver"}], "packageName": "apache-airflow-providers-amazon", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T20:16:19.163", "references": [{"url": "https://github.com/apache/airflow/pull/65703", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/19/36", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue."}, {"lang": "es", "value": "En los backends de secretos de AWS Secrets Manager y SSM Parameter Store de 'apache-airflow-providers-amazon' anteriores a la versi\u00f3n 9.28.0, la l\u00f3gica de alcance de equipo podr\u00eda resolver un 'conn_id' que contuviera un / (por ejemplo, my_team/conn ) a la misma ruta que un secreto con alcance de equipo de otro equipo cuando el llamador no ten\u00eda contexto de equipo. Un llamador privilegiado sin contexto de equipo podr\u00eda, por lo tanto, recuperar el secreto de otro equipo al crear un 'conn_id' en colisi\u00f3n. Corregido en la versi\u00f3n 9.28.0 al cambiar el separador de alcance de equipo a -- y rechazando los 'conn_id' con forma de equipo cuando el contexto de equipo est\u00e1 ausente. Afecta solo a la caracter\u00edstica experimental de equipos multi-inquilino. Se recomienda a los usuarios actualizar a 'apache-airflow-providers-amazon' 9.28.0, que corrige el problema."}], "lastModified": "2026-07-24T09:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC5DFF6C-DFC7-465A-80C6-108810DE093E", "versionEndExcluding": "9.28.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}