Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow Google provider | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 12 Aug 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name. | |
| Title | Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables | |
| Weaknesses | CWE-1220 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-08-12T10:33:10.387Z
Reserved: 2026-07-31T19:38:02.067Z
Link: CVE-2026-68868
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-12T11:17:10.063
Modified: 2026-08-12T11:17:10.063
Link: CVE-2026-68868
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-1220
Insufficient Granularity of Access Control