CVE-2026-76185

UNKNOWN 0.0

Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.

CWE	CWE-668
Vendor	apache software foundation
Product	apache airflow task sdk
Published	Nov 9, 2026
Last Updated	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache airflow task sdk

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache airflow task sdk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Airflow Task SDK

1.2.0 < 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/airflow/pull/72201 lists.apache.org: https://lists.apache.org/thread.html/6rqgrbqyvry6gn7g3rtrfk35gbrq6d50 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/09/6

Credits

Nurmuhammad Davronbekov Jarek Potiuk