Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends

TRUNG BÌNH 5.3CVE-2026-42526 · GHSA-g9qc-qf28-hhqx · PYSEC-2026-595 · Công bố 19/05/2026 · cập nhật 24/07/2026

Tóm tắt nhanh

CVE-2026-42526 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng apache-airflow-providers-amazon, apache-airflow-providers-amazon (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.41%, cao hơn 35.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.28.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
apache-airflow-providers-amazon PyPI	`< 9.28.0`	`9.28.0`
apache-airflow-providers-amazon apache	`< 9.28.0`	`9.28.0`

Mô tả

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a / (e.g. "my_team/conn") to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to -- and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to apache-airflow-providers-amazon 9.28.0, which fixes the issue.

Mô tả của NVD

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.