Apache Airflow Amazon Provider
Monthly
Cross-team secret disclosure in Apache Airflow Amazon Provider (all versions before 9.34.0) allows an authenticated Airflow team member to read Connections, Variables, or Configuration secrets belonging to a different team in a multi-team deployment. By crafting a lookup ID that embeds the '--' team namespace separator, an attacker causes the provider's team-scoped lookup to miss and the pre-patch team-agnostic fallback to resolve the target team's AWS Secrets Manager or SSM Parameter Store secret in plaintext. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploit technique is mechanically straightforward given the documented '--' naming convention.
Cross-team secret disclosure in apache-airflow-providers-amazon before 9.28.0 allows an authenticated low-privilege caller without team context to read secrets belonging to other teams by supplying a crafted `conn_id` containing a `/` character that collides with another team's AWS Secrets Manager or SSM Parameter Store path. The flaw exists exclusively in the experimental multi-tenant teams feature and is caused by incorrect authorization (CWE-863): the backend failed to reject team-shaped `conn_id`s when no team context was present. No public exploit exists, CISA has not listed this in KEV, and EPSS sits at 0.03% (8th percentile), reflecting low current exploitation probability given the non-default prerequisite.
Cross-team secret disclosure in Apache Airflow Amazon Provider (all versions before 9.34.0) allows an authenticated Airflow team member to read Connections, Variables, or Configuration secrets belonging to a different team in a multi-team deployment. By crafting a lookup ID that embeds the '--' team namespace separator, an attacker causes the provider's team-scoped lookup to miss and the pre-patch team-agnostic fallback to resolve the target team's AWS Secrets Manager or SSM Parameter Store secret in plaintext. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploit technique is mechanically straightforward given the documented '--' naming convention.
Cross-team secret disclosure in apache-airflow-providers-amazon before 9.28.0 allows an authenticated low-privilege caller without team context to read secrets belonging to other teams by supplying a crafted `conn_id` containing a `/` character that collides with another team's AWS Secrets Manager or SSM Parameter Store path. The flaw exists exclusively in the experimental multi-tenant teams feature and is caused by incorrect authorization (CWE-863): the backend failed to reject team-shaped `conn_id`s when no team context was present. No public exploit exists, CISA has not listed this in KEV, and EPSS sits at 0.03% (8th percentile), reflecting low current exploitation probability given the non-default prerequisite.