Vulnerability Details CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 33.3%
CVSS Severity
CVSS v3 Score 5.3
References
Products affected by CVE-2026-42526
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:1.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:1.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:1.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:1.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:1.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:2.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:3.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:3.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:3.1.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:3.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:3.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:3.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:4.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:4.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:5.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:5.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:6.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:6.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:6.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.2.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:7.4.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.10.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.11.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.12.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.13.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.14.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.15.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.16.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.17.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.18.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.19.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.20.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.21.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.22.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.23.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.24.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.25.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.26.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.27.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.28.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.29.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.3.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.5.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.7.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.8.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:8.9.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.10.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.11.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.12.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.13.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.14.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.15.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.16.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.17.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.18.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.18.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.19.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.20.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.21.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.22.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.23.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.24.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.25.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.26.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.27.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.6.1
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.8.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.9.0
-
cpe:2.3:a:apache:apache-airflow-providers-amazon:9.9.1