CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g.
Published May 19, 2026 · updated Jul 24, 2026 · apache apache-airflow-providers-amazon
In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g. ) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding . Fixed in 9.28.0 by switching the team-scope separator to and rejecting team-shaped s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to 9.28.0, which fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 19, 2026 · NIST NVD
Detected
In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g. ) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding . Fixed in 9.28.0 by switching the team-scope sep
Jul 24, 2026 · NIST NVD
Updated
In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g. ) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding . Fixed in 9.28.0 by switching the team-scope sep
Affected
- cpe apache/apache-airflow-providers-amazonversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-42526
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g. ) to the same path as another team's team-scoped secret when the calle
nvd.nist.gov