CVE-2026-76185
— UNSCOREDpublic exploit availablePublished 2026-11-09 · Updated 2026-11-09
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected. Users are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`.
Weaknesses
CWE-668
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2025-10149
- HIGHCVE-2026-102125PoC
- HIGHCVE-2026-102262
- UNSCOREDCVE-2026-102280PoC
- HIGHCVE-2026-104073PoC
- LOWCVE-2026-105746PoC
- MEDIUMCVE-2026-105754PoC
- MEDIUMCVE-2026-106354
Related by shared AI tags and CWE weakness class. Browse the full archive.