CVE-2026-42526: Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends
In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / (e.g. "myteam/conn") to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding connid. Fixed in 9.28.0 by switching the team-scope separator to -- and rejecting team-shaped connids when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to apache-airflow-providers-amazon 9.28.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-amazonto a version that resolves this vulnerability.Fixed in 9.28.0Patch CVE-2026-42526 - Configuration
After upgrading to 9.28.0, ensure the provider switches the team-scope separator to `--` and rejects team-shaped `conn_id`s when team context is absent to prevent resolution of `conn_id`s with `/` (e.g., `my_team/conn`) to another team's secret.
apache-airflow-providers-amazon AWS Secrets Manager & SSM Parameter Store secrets backends team-scope separator and conn_id validation when team context is absent = Use `--` as the team-scope separator; reject team-shaped `conn_id`s containing the team scope when team context is absent
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42526?
CVE-2026-42526 has a medium severity rating of 5.3.
How do I fix CVE-2026-42526?
To fix CVE-2026-42526, upgrade to version 9.28.0 or later of the apache-airflow-providers-amazon package.
What exploit does CVE-2026-42526 address?
CVE-2026-42526 addresses unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store.
What impact does CVE-2026-42526 have on security?
CVE-2026-42526 allows potential unauthorized access to sensitive team-scoped secrets.
Which software is affected by CVE-2026-42526?
CVE-2026-42526 affects the apache-airflow-providers-amazon package prior to version 9.28.0.