Title: Apache Airflow Amazon provider, Description: En los backends de secretos de AWS Secrets Manager y SSM Parameter Store de 'apache-airflow-providers-amazon' anteriores a la versión 9.28.0, la lógica de alcance de equipo podría resolver un 'conn_id' que contuviera un  /  (por ejemplo,  my_team/conn ) a la misma ruta que un secreto con alcance de equipo de otro equipo cuando el llamador no tenía contexto de equipo. Un llamador privilegiado sin contexto de equipo podría, por lo tanto, recuperar el secreto de otro equipo al crear un 'conn_id' en colisión. Corregido en la versión 9.28.0 al cambiar el separador de alcance de equipo a  --  y rechazando los 'conn_id' con forma de equipo cuando el contexto de equipo está ausente. Afecta solo a la característica experimental de equipos multi-inquilino. Se recomienda a los usuarios actualizar a 'apache-airflow-providers-amazon' 9.28.0, que corrige el problema.

OR
          *cpe:2.3:a:apache:airflow_providers_amazon:*:*:*:*:*:*:*:* versions up to (excluding) 9.28.0

OR
          *cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:* versions up to (excluding) 9.28.0

OR
          *cpe:2.3:a:apache:airflow_providers_amazon:*:*:*:*:*:*:*:* versions up to (excluding) 9.28.0

Apache Software Foundation: https://github.com/apache/airflow/pull/65703 Types: Issue Tracking, Patch

Apache Software Foundation: https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn Types: Mailing List, Vendor Advisory

CVE: http://www.openwall.com/lists/oss-security/2026/05/19/36 Types: Mailing List, Third Party Advisory

{"timestamp":"2026-05-19T19:53:21.498429Z","id":"CVE-2026-42526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Apache Software Foundation","product":"Apache Airflow Amazon provider","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"apache-airflow-providers-amazon","versions":[{"version":"0","lessThan":"9.28.0","versionType":"semver","status":"affected"}]}]

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

http://www.openwall.com/lists/oss-security/2026/05/19/36

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

CWE-863

https://github.com/apache/airflow/pull/65703

https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn