CVE-2026-42526General(apache / apache-airflow-providers-amazon)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/apache/airflow/pull/65703

Vendor / third-party advisories

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

apache-airflow-providers-amazon

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-05-19); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

apache

Products

apache-airflow-providers-amazon

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-19	2	General2
2026-05-20	1	Disclosure1

Full discourse3 posts

Open Source Security mailing list@oss_security142d
Disclosure
CVE-2026-27173: Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line https://www.openwall.com/lists/oss-security/2026/05/19/35 CVE-2026-42526: Apache Airflow Amazon provider: Unauthorized access in AWS Secrets Manager & SSM Parameter Store backends https://www.openwall.com/lists/oss-security/2026/05/19/36
Post summary
The post announces two newly disclosed Apache Airflow CVEs: one that exposes JWT tokens in the KubernetesExecutor command line and another that permits unauthorized access to AWS Secrets Manager and SSM Parameter Store backends.
00071467
4.7K followersView on X
CVE@CVEnew142d
General
CVE-2026-42526 In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn… https://www.cve.org/CVERecord?id=CVE-2026-42526
Post summary
The post reports a vulnerability in apache‑airflow‑providers‑amazon prior to 9.28.0 affecting AWS Secrets Manager/SSM backends, noting a flaw in team‑scoping logic, without providing evidence of exploitation or mitigation.
00000113
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds142d
General
CVE-2026-42526 CVE-2026-42526 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42526 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text lists CVE-2026-42526 and provides two URLs to vulnerability details and a notification, but offers no additional information such as PoC, exploit details, or patch information.
0000056
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	apache-airflow-providers-amazon	-	-	-

Explore more

Back to dashboard apache CVEs apache-airflow-providers-amazon vulnerabilities

What researchers are saying

CVE-2026-42526

Open Source Security mailing list@oss_securityDisclosure

The post announces two newly disclosed Apache Airflow CVEs: one that exposes JWT tokens in the KubernetesExecutor command line and another that permits unauthorized access to AWS Secrets Manager and SSM Parameter Store backends.

CVE@CVEnewGeneral

The post reports a vulnerability in apache‑airflow‑providers‑amazon prior to 9.28.0 affecting AWS Secrets Manager/SSM backends, noting a flaw in team‑scoping logic, without providing evidence of exploitation or mitigation.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text lists CVE-2026-42526 and provides two URLs to vulnerability details and a notification, but offers no additional information such as PoC, exploit details, or patch information.