CVE-2026-68868
Last modified
CVE-2026-68868 is a vulnerability of currently unknown severity. The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full.
Description
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow Google provider | < 22.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-68868?
How severe is CVE-2026-68868?
How do I fix CVE-2026-68868?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-68820Use after free in Windows Ancillary Function Driver for WinS…7
- CVE-2026-68821Improper privilege management in Windows Package Manager all…7.3
- CVE-2026-68823Exposed dangerous method or function in Azure Confidential L…9.1
- CVE-2026-6883GitLab has remediated an issue in GitLab EE affecting all ve…4.3
- CVE-2026-6885Borg SPM 2007 (Sales Ended in 2008) developed by BorG Techno…9.8
- CVE-2026-6886Borg SPM 2007 (Sales Ended in 2008) developed by BorG Techno…9.8
- CVE-2026-68869Rejected reason: This CVE ID was assigned in error. Upon fur…
- CVE-2026-6887Borg SPM 2007 (Sales Ended in 2008) developed by BorG Techno…9.8
- CVE-2026-68870The Azure Key Vault secrets backend in Apache Airflow's Micr…
- CVE-2026-68871The Yandex Lockbox secrets backend in Apache Airflow's Yande…
- CVE-2026-68872The AWS Systems Manager Parameter Store and Secrets Manager …6.5
- CVE-2026-6888Successful exploitation of the SQL injection vulnerability c…7.2
Are you affected by CVE-2026-68868?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST