Threats tagged 'ghsa-mvjw-vxf4-7g94'

Apache Airflow versions with multi-team deployments and secret cache enabled have a vulnerability where secret cache keys are constructed using unescaped underscore delimiters from team names and secret IDs. This can cause key collisions allowing a DAG author to access another team's Variable or Connection values. The issue affects deployments with both core.multi_team = True and secrets.use_cache = True. Upgrading to Apache Airflow 3.4.0 or later or disabling the secret cache mitigates the issue.