Apache Airflow Task SDK Vulnerability Allows Data Exposure Across Teams

CVE-2026-76185

What is CVE-2026-76185?

A vulnerability exists in the Task SDK of Apache Airflow where the secret cache generates its keys using unescaped _ delimiters from the team name and secret ID. This flaw can lead to collisions in different (team, secret ID) pairs. In environments where both multi-team support is enabled and caching of secrets is activated, a DAG author may unintentionally gain access to another team's Variable or Connection values. To mitigate this issue, users should upgrade to Apache Airflow version 3.4.0 or later. For those unable to upgrade, disabling the cache by setting 'secrets.use_cache' to 'False' is recommended.

References