https://seclists.org/oss-sec/2026/q2/608: CVE-2026-42526: Apache Airflow Amazon provider: Pvent unauthorized access to team-scoped sects in AWS Sects Manager and SSM Parameter Stobackends

Q: Who is exposed to this issue?

Only deployments using the experimental multi-tenant teams feature with the AWS Secrets Manager or SSM Parameter Store secrets backends are affected. The issue applies to apache-airflow-providers-amazon versions before 9.28.0.

Q: What does an attacker need to exploit it?

The caller must be privileged and have no team context. They must craft a conn_id containing a slash that collides with another team's team-scoped secret path.

Q: Are deployments without the multi-tenant teams feature affected?

No. The advisory states that the issue affects the experimental multi-tenant teams feature only.

Q: What should be done if the affected feature is in use?

Upgrade apache-airflow-providers-amazon to version 9.28.0. This version changes the team-scope separator and rejects team-shaped conn_ids when no team context is present.

Published May 19, 2026

Updated

Affected Software

1 affected component

pypi/apache-airflow-providers-amazon<9.28.0

Frequently Asked Questions

Who is exposed to this issue?

Only deployments using the experimental multi-tenant teams feature with the AWS Secrets Manager or SSM Parameter Store secrets backends are affected. The issue applies to apache-airflow-providers-amazon versions before 9.28.0.

What does an attacker need to exploit it?

The caller must be privileged and have no team context. They must craft a conn_id containing a slash that collides with another team's team-scoped secret path.

Are deployments without the multi-tenant teams feature affected?

No. The advisory states that the issue affects the experimental multi-tenant teams feature only.

What should be done if the affected feature is in use?

Upgrade apache-airflow-providers-amazon to version 9.28.0. This version changes the team-scope separator and rejects team-shaped conn_ids when no team context is present.