CVE-2026-42526

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

• CWE-863

• https://github.com/apache/airflow/pull/65703Issue Tracking, Patch
• https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtynMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/19/36Mailing List, Third Party Advisory

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42520Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and ea…7.5
• CVE-2026-42521Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 thro…6.5
• CVE-2026-42522A missing permission check in Jenkins GitHub Branch Source P…4.3
• CVE-2026-42523Jenkins GitHub Plugin 1.46.0 and earlier improperly processe…9
• CVE-2026-42524Jenkins HTML Publisher Plugin 427 and earlier does not escap…8
• CVE-2026-42525Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.…4.3
• CVE-2026-42527Deserialization of Untrusted Data vulnerability in Apache Ca…8.1
• CVE-2026-4253A security flaw has been discovered in Tenda AC8 16.03.50.11…7.2
• CVE-2026-42530NGINX Open Source has a vulnerability in the ngx_http_v3_mod…9.2
• CVE-2026-42533A vulnerability exists in NGINX Plus and NGINX Open Source w…9.2
• CVE-2026-42534NLnet Labs Unbound up to and including version 1.25.0 has a …5.3
• CVE-2026-42535A path handling issue in mod_dav_fs in Apache 2.4.67 and ear…9.1