Unrated severityNVD Advisory· Published Nov 9, 2026· Updated Nov 9, 2026
CVE-2026-76185
CVE-2026-76185
Description
Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped _ delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both core.multi_team = True and secrets.use_cache = True are affected.
Users are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set secrets.use_cache = False.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.