Database/Control plane, storage & DevOps
Apache Airflow Task SDK: secret cache key collision exposes other teams' Variables and Connections
Impact
The Task SDK built secret cache keys by joining the team name and secret id with unescaped _ characters, so two different (team, secret id) pairs could produce the same key. In a multi-team deployment, a Dag author can pick a secret id that collides with another team's entry and read that team's Variable or Connection value. This breaks the isolation that multi-team mode exists to provide on a shared Airflow instance.
Who can reach it
A Dag author in one team of a multi-team deployment. Requires the ability to deploy Dag code. Only affects deployments with both core.multi_team = True and secrets.use_cache = True.
What to do
Upgrade to apache-airflow 3.4.0 or later and restart the Airflow components. If you cannot upgrade, set secrets.use_cache = False and restart. Deployments without multi-team mode or without the secrets cache are not affected.
References
Related entries
- Apache Airflow: deadline alert fields let Dag authors construct allow-listed classes in the schedulerCVE-2026-82337 · Apache Airflow (deadline alert deserialization in scheduler and API server)Unscored
- Apache Airflow CLI: position-based masking leaves secrets in cleartext in the audit logCVE-2026-86468 · Apache Airflow CLI (audit log argument masking)Unscored
- Apache Airflow scheduler: task-written XCom values are fully deserialized in the scheduler processCVE-2026-86829 · Apache Airflow scheduler (XCom deserialization during dependency evaluation)Unscored
- NVMe/TCP host: a short read is reported to userspace as a complete readCVE-2026-89480 · Linux kernel nvme-tcp host (short-read completion accounting)Unscored
- NVMe/TCP host: a malicious target can read host kernel memory by sending R2T for a READCVE-2026-89481 · Linux kernel nvme-tcp host (R2T direction check)Unscored
- NVMe/TCP host: C2HData for a WRITE_ZEROES command writes into a stale iteratorCVE-2026-89482 · Linux kernel nvme-tcp host (C2HData receive gate, WRITE_ZEROES path)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.