Team Scoping Vulnerability in Apache Airflow Google Provider by Google
CVE-2026-68868

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow Google Provider
Vendor
CVE Published:
12 August 2026

What is CVE-2026-68868?

A vulnerability exists in the Google Cloud Secret Manager backend of Apache Airflow's Google provider where the team-specific context is not correctly enforced. This flaw allows tasks or DAGs from one team to access sensitive connections and variables that belong to another team when running in multi-team mode. As a result, the internal call boundary drops the caller's team name, leading to potential unauthorized access to credentials. Users are encouraged to upgrade to version 22.3.0 or later to mitigate this exposure.

Affected Version(s)

Apache Airflow Google provider 0 < 22.3.0

References

https://github.com/apache/airflow/pull/70869
patch
https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh59...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Airflow security team
Jarek Potiuk
.