Apache Airflow Task SDK before 1.4.0 allows cross-team secret disclosure (CVE-2026-76185)
Original title: CVE-2026-76185: Apache Airflow Task SDK: Task SDK SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode
Different secret ids can collide in multi-team deployments, disclosing variables or connections.
Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters. This enables collisions. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both team and multi-team mode are affected.
- Cache key uses unescaped underscores
- Allows cross-team secret access
- Affects multi-team deployments
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76185 | Cross-team secret disclosure in Apache Airflow Task SDK (multi_team=True) | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: important Affected versions: - Apache Airflow Task SDK 1. 2. 0 before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.