Team Scoping Vulnerability in Apache Airflow Google Provider by Google
CVE-2026-68868

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Airflow Google Provider
Vendor
CVE Published:
12 August 2026

What is CVE-2026-68868?

A vulnerability exists in the Google Cloud Secret Manager backend of Apache Airflow's Google provider where the team-specific context is not correctly enforced. This flaw allows tasks or DAGs from one team to access sensitive connections and variables that belong to another team when running in multi-team mode. As a result, the internal call boundary drops the caller's team name, leading to potential unauthorized access to credentials. Users are encouraged to upgrade to version 22.3.0 or later to mitigate this exposure.

Affected Version(s)

Apache Airflow Google provider 0 < 22.3.0

References

https://github.com/apache/airflow/pull/70869
patch
https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh59...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Airflow security team
Jarek Potiuk
.