EUVD-2026-30974
GHSA-g9qc-qf28-hhqx
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L for required Airflow authentication; AC:H for non-default experimental teams feature prerequisite; C:H for cross-team secret disclosure; no integrity or availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a / (e.g. "my_team/conn") to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to -- and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to apache-airflow-providers-amazon 9.28.0, which fixes the issue.
AnalysisAI
Cross-team secret disclosure in apache-airflow-providers-amazon before 9.28.0 allows an authenticated low-privilege caller without team context to read secrets belonging to other teams by supplying a crafted conn_id containing a / character that collides with another team's AWS Secrets Manager or SSM Parameter Store path. The flaw exists exclusively in the experimental multi-tenant teams feature and is caused by incorrect authorization (CWE-863): the backend failed to reject team-shaped conn_ids when no team context was present. No public exploit exists, CISA has not listed this in KEV, and EPSS sits at 0.03% (8th percentile), reflecting low current exploitation probability given the non-default prerequisite.
Technical ContextAI
The vulnerability resides in the _get_secret methods of both secrets_manager.py and systems_manager.py within the Apache Airflow Amazon provider (CPE: cpe:2.3:a:apache_software_foundation:apache_airflow_amazon_provider:*:*:*:*:*:*:*:*). The experimental multi-tenant teams feature namespaces AWS Secrets Manager and SSM Parameter Store paths using the team name as a path prefix. Prior to 9.28.0, the separator between team name and secret ID was /, making team marketing's secret smtp_default resolve to airflow/connections/marketing/smtp_default. Because / is also the native AWS path delimiter, a caller without team context could request a conn_id of marketing/smtp_default and the path-building logic would construct the identical AWS path, bypassing team isolation. The root cause (CWE-863: Incorrect Authorization) is that the code performed no guard against a teamless caller presenting a conn_id shaped like a team-scoped path. The fix in PR #65703 changes the separator to -- (making the canonical path airflow/connections/marketing--smtp_default) and inserts a regex guard re.fullmatch(r"[^-]+--.+", secret_id) that returns None immediately when team context is absent and the conn_id matches the new team-scoped pattern.
RemediationAI
Upgrade apache-airflow-providers-amazon to version 9.28.0 or later, which is the vendor-confirmed fix (upstream PR: https://github.com/apache/airflow/pull/65703; vendor advisory: https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn). If an immediate upgrade is not feasible and the experimental teams feature is active, disable the experimental multi-tenant teams feature entirely until the patch is applied - this removes the vulnerable code path at the cost of losing team-scoped secret isolation. As a secondary defense for environments that cannot disable the teams feature, audit AWS IAM policies to ensure that Airflow task execution roles carry the minimum necessary GetSecretValue or GetParameter permissions scoped to their own team's path prefix, limiting what any cross-team path traversal can actually retrieve. No side effects are expected from upgrading to 9.28.0 beyond the separator change to --, which requires renaming any existing team-scoped secrets in AWS to use -- instead of /.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today