Apache Software Foundation Apache Airflow Amazon Provider vulnerabilities

CVE-2026-68872 [MEDIUM] CWE-639 CVE-2026-68872: The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon prov The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another te

CVE-2026-42526 [MEDIUM] CWE-863 CVE-2026-42526: In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-ama In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could t

CVE-2026-40948 [MEDIUM] CWE-352 CVE-2026-40948: The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or valid The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the a