Database/Control plane, storage & DevOps
Airflow Amazon provider: AWS secrets backends fall through to a team-agnostic lookup, leaking other teams' credentials
Impact
Both the Systems Manager Parameter Store and the Secrets Manager backends retry a missed team-scoped Connection or Variable id through the team-agnostic lookup. In a multi-team deployment, a caller in one team can supply an id spelling out another team's namespace and read that team's secret verbatim. In practice these hold the AWS credentials, registry logins and cluster tokens other teams' pipelines run with, so the leak extends well past Airflow itself. Only multi-team mode with one of these two backends is required.
Who can reach it
Any authenticated Airflow user or Dag author in one team of a multi-team deployment using the SSM Parameter Store or Secrets Manager backend.
What to do
Upgrade apache-airflow-providers-amazon to 9.34.0 or later and restart scheduler, triggerer and workers. Rotate credentials stored in either backend that another team could have resolved.
References
Related entries
- Airflow: bulk Variable and Connection endpoints write secrets to the audit log in cleartextCVE-2026-68969 · Apache Airflow (audit-log masking on bulk Variables/Connections endpoints)Medium
- Airflow Task SDK: Variables whose JSON value is a list are not masked in task logs or rendered templatesCVE-2026-68970 · Apache Airflow Task SDK (secret masking for list-valued Variables)Medium
- Airflow: asset materialization authorizes the Dag without its team, letting one team trigger another's runsCVE-2026-68971 · Apache Airflow (asset materialize endpoint and wait_dag_run_until_finished XCom check)Medium
- GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium
- Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
- Airflow Akeyless provider: path-shaped Variable key bypasses the team-scope guard on secret lookupCVE-2026-86465 · Apache Airflow Akeyless provider (secrets backend, team-scope guard)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.