https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:54:33.580364+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-ge58327 CLEANSTART-2026-GE58327 — Security fix for CVE-2026-42526 applied in: airflow-3 3.0.6-r1, airflow-3 3.1.8-r5, airflow-3 3.2.1-r5 2026-10-03T16:54:33.658101+00:00

Affected: CleanStart: airflow-3

CVE-2026-42526 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-319505 EUVD-2026-319505 2026-10-03T16:54:33.658165+00:00 EUVD-2026-319505 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42526 fkie_cve-2026-42526 2026-10-03T16:54:33.658195+00:00

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-g9qc-qf28-hhqx GHSA-g9qc-qf28-hhqx — Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Param… 2026-10-03T16:54:33.658224+00:00

Affected: PyPI: apache-airflow-providers-amazon

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-595 PYSEC-2026-595 2026-10-03T16:54:33.658251+00:00

Affected: PyPI: apache-airflow-providers-amazon

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1595 WID-SEC-W-2026-1595 — Apache Airflow: Mehrere Schwachstellen 2026-10-03T16:54:33.658275+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.