{"id":"CVE-2026-76185","aliases":["EUVD-2026-119904","GHSA-mvjw-vxf4-7g94"],"status":"published","title":"Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode","description":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-668"],"published":"2026-11-09T09:53:57Z","modified":"2026-11-09T13:05:16Z","products":[{"vendor":"apache software foundation","product":"apache airflow task sdk"}],"references":[{"url":"https://github.com/apache/airflow/pull/72201","tags":["patch"]},{"url":"https://lists.apache.org/thread.html/6rqgrbqyvry6gn7g3rtrfk35gbrq6d50","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76185"},{"url":"https://github.com/advisories/GHSA-mvjw-vxf4-7g94"}],"sources":{"cve":[{"id":"CVE-2026-76185","title":"Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode","description":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.","status":"published","published":"2026-11-09T09:53:57.995Z","modified":"2026-11-09T13:05:16.726Z","cwes":["CWE-668"],"updated_at":"2026-11-09T14:33:34.013968Z"}],"euvd":[{"id":"EUVD-2026-119904","description":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.","status":"published","published":"2026-11-09T09:53:57Z","modified":"2026-11-09T13:05:16Z","updated_at":"2026-11-09T15:17:14.840893Z"}],"ghsa":[{"id":"GHSA-mvjw-vxf4-7g94","title":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with...","description":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.","status":"published","published":"2026-11-09T12:31:41Z","modified":"2026-11-09T12:31:47Z","cwes":["CWE-668"],"updated_at":"2026-11-09T12:48:05.483669Z"}],"nvd":[{"id":"CVE-2026-76185","description":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.","status":"published","published":"2026-11-09T10:17:11.297Z","modified":"2026-11-09T11:17:26.103Z","cwes":["CWE-668"],"updated_at":"2026-11-09T14:14:36.135874Z"}]}}