CVE-2026-68872

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.34.0

Description The AWS Systems Manager Parameter Store and Secrets Manager backends in the Amazon provider resolve a team-scoped Connection or Variable id through a team-agnostic lookup if the initial team-scoped lookup fails. In deployments utilizing multi-team mode, a user in one team can access secrets belonging to another team by providing an id that matches that team's namespace, allowing full retrieval of credentials.

Recommendations Upgrade to apache-airflow-providers-amazon version 9.34.0 or later.