https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T09:20:57.262178+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-vm33357 CLEANSTART-2026-VM33357 — Security fix for CVE-2026-68872 applied in: airflow-3 3.0.6-r5, airflow-3 3.1.8-r9, airflow-3 3.2.1-r8, airflow-3 3.2.2… 2026-10-10T09:20:57.331066+00:00

Affected: CleanStart: airflow-3

CVE-2026-68872 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-369580 EUVD-2026-369580 2026-10-10T09:20:57.331128+00:00 EUVD-2026-369580 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68872 fkie_cve-2026-68872 2026-10-10T09:20:57.331145+00:00

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

 https://cve.radiocsirt.org/vuln/ghsa-984p-rgj2-h89x GHSA-984p-rgj2-h89x 2026-10-10T09:20:57.331174+00:00

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

 https://cve.radiocsirt.org/vuln/pysec-2026-3713 PYSEC-2026-3713 2026-10-10T09:20:57.331193+00:00

Affected: PyPI: apache-airflow-providers-amazon

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2733 WID-SEC-W-2026-2733 — Apache Airflow Provider: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen 2026-10-10T09:20:57.331228+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Informationen offenzulegen.