CVE-2026-68872

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

• CWE-639

• https://github.com/apache/airflow/pull/70878Issue Tracking, Patch
• https://lists.apache.org/thread/9nd31g40rd2zpgwwymskvjpfq1xnmllgMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/08/10/6Mailing List, Third Party Advisory

Published

Aug 10, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68863Dell PowerProtect One, versions 20.1.0.0 and below, contain …7.5
• CVE-2026-68868The Google Cloud Secret Manager secrets backend in Apache Ai…6.5
• CVE-2026-68869Rejected reason: This CVE ID was assigned in error. Upon fur…
• CVE-2026-6887Borg SPM 2007 (Sales Ended in 2008) developed by BorG Techno…9.8
• CVE-2026-68870The Azure Key Vault secrets backend in Apache Airflow's Micr…5.3
• CVE-2026-68871The Yandex Lockbox secrets backend in Apache Airflow's Yande…6.5
• CVE-2026-68873Insertion of sensitive information into log file in Windows …5.5
• CVE-2026-68874Out-of-bounds read in Windows Program Compatibility Assistan…5.7
• CVE-2026-68875Buffer over-read in Windows NTFS allows an authorized attack…7.8
• CVE-2026-68876Heap-based buffer overflow in Windows Program Compatibility …8
• CVE-2026-68877Heap-based buffer overflow in Windows Storage Spaces Control…7.8
• CVE-2026-68878Stack-based buffer overflow in Windows Fast FAT Driver allow…8