CVE-2026-68868 json
Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
published 2026-08-12 2 mo ago modified 2026-10-24 15 d ago also EUVD-2026-57163 , PYSEC-2026-3714
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
Patch / fix
- pypi apache-airflow-providers-google 22.3.0
- Apache Software Foundation Apache Airflow Google provider 22.3.0
- github.com/apache/airflow#70869 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow-providers-google | <22.3.0 |
22.3.0 |
Affected products
- Apache Software Foundation Apache Airflow Google provider
Classification
- Weakness
-
- CWE-1220 Insufficient Granularity of Access Control
References
-
github.com
/apache/airflow/pull/70869
patch, issue-tracking
-
lists.apache.org
/thread/03h5y0fmqlh0yf055zlocxh591ozx69x
vendor-advisory, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/08/12/3
mailing-list, third-party-advisory, advisory
Sources
- CVE List CVE-2026-68868
- NVD CVE-2026-68868
- OSV PYSEC-2026-3714
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.