CVE-2026-68872Medium· 6.5▾ SunlitThe AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deploymen…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.6%
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
apache-airflow-providers-amazon < 9.34.0Upgrade past the affected range:
apache-airflow-providers-amazon 9.34.0Affected packages:
apache-airflow-providers-amazon < 9.34.0Patched in:
apache-airflow-providers-amazon 9.34.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-25956High· 7.5Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information
CVE-2026-25604Medium· 5.4In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access co…
CVE-2026-86467NoneApache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
CVE-2026-81930Medium· 6.3Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs
CVE-2026-81914Medium· 4.3Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them
CVE-2026-82355Medium· 4.2When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer ove…