CVE-2026-68868 PUBLISHED

Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

Assigner: apache
Reserved: 31.07.2026 Published: 12.08.2026 Updated: 12.08.2026

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team_name was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.

Product Status

Vendor Apache Software Foundation
Product Apache Airflow Google provider
Versions Default: unaffected
  • affected from 0 to 22.3.0 (excl.)

Credits

  • Apache Airflow security team finder
  • Jarek Potiuk remediation developer

References

Problem Types

  • CWE-1220: Insufficient Granularity of Access Control CWE