---
id: CVE-2026-42526
title: >-
  In the AWS Secrets Manager and SSM Parameter Store secrets backends of
  `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic
  could resolve a `conn_id` containing a `/` (e.g
summary: >-
  In the AWS Secrets Manager and SSM Parameter Store secrets backends of
  `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic
  could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same
  path as anoth…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
vendor: apache
product: airflow_providers_amazon
affected:
  - airflow_providers_amazon < 9.28.0
patched:
  - airflow_providers_amazon 9.28.0
published: '2026-05-19'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42526'
references:
  - url: 'https://github.com/apache/airflow/pull/65703'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/05/19/36'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.0054
epssPercentile: 0.42985
ingestedAt: '2026-07-01T09:50:45.847Z'
---

## Overview

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

## Affected

- `airflow_providers_amazon < 9.28.0`

## Remediation

Upgrade past the affected range:

- `airflow_providers_amazon 9.28.0`