{"id":"CVE-2026-42526","aliases":["GHSA-g9qc-qf28-hhqx","PYSEC-2026-595"],"url":"https://o3.security/vulnerability/CVE-2026-42526","summary":"Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends","details":"In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.","published":"2026-05-19T19:17:51.565Z","modified":"2026-08-12T03:51:47.504083589Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00413,"percentile":0.34482,"asOf":"2026-08-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"apache-airflow-providers-amazon","fixedVersion":"9.28.0"}],"fix":{"url":"https://github.com/apache/airflow/pull/65703","label":"apache/airflow#65703"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/05/19/36"},{"type":"WEB","url":"https://pypi.python.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42526.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42526"},{"type":"FIX","url":"https://github.com/apache/airflow/pull/65703"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:47.504083589Z"}}