Description
Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.

Users are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.
Published: 2026-11-09
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 13:15:00 +0000

Type Values Removed Values Added
Title Apache Airflow Task SDK: Task SDK SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode

Mon, 09 Nov 2026 11:30:00 +0000

Type Values Removed Values Added
References

Mon, 09 Nov 2026 10:00:00 +0000

Type Values Removed Values Added
Description Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.
Title Apache Airflow Task SDK: Task SDK SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode
Weaknesses CWE-668
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-09T13:05:16.726Z

Reserved: 2026-08-19T10:41:07.241Z

Link: CVE-2026-76185

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T10:17:11.297

Modified: 2026-11-09T11:17:26.103

Link: CVE-2026-76185

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T11:45:09Z

Weaknesses
  • CWE-668

    Exposure of Resource to Wrong Sphere