The vulnerability arises because the AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider perform a team-agnostic lookup when a team-scoped lookup fails. In multi-team mode, this fallback allows a user from one team to supply an ID that resolves to another team's namespace, thereby bypassing authorization and accessing that team's secrets. This flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The fix in version 9.34.0 prevents the fallback for IDs that could name a different team namespace, mitigating the unauthorized access.

An attacker with access to a multi-team mode deployment of Apache Airflow using the affected Amazon provider backends can retrieve secrets and credentials belonging to other teams without proper authorization. This could lead to unauthorized disclosure of sensitive information and potential misuse of those credentials. No unusual configuration is required beyond enabling multi-team mode and using one of the affected backends.

A fix is available in apache-airflow-providers-amazon version 9.34.0 and later, which disables the team-agnostic fallback for IDs that could reference other team namespaces. Users should upgrade to this version or later to remediate the vulnerability. Since this is a cloud service component, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor advisory for the latest status.