CVE-2026-68868

Analyzed Analyzed - Analysis Complete

Google Cloud Secret Manager Credential Exposure in Apache Airflow

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: Apache Software Foundation

Description

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68868

EUVD

EUVD-2026-57163

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache-airflow-providers-google	to 22.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1220	The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Airflow's Google Cloud Secret Manager backend allows unauthorized cross-team access to secrets. The system accepted a team name parameter but ignored it during secret lookups, causing all requests to resolve against team-agnostic secret names. This meant a task from one team could access another team's credentials without proper validation.

Detection Guidance

Check Apache Airflow logs for unauthorized secret access attempts or cross-team secret resolutions. Review secret names in Google Secret Manager for team-scoped patterns like <team>--<secret_id>. Audit connections and variables for unexpected team access in multi-team deployments.

Impact Analysis

In multi-team deployments using this backend, attackers could exploit this flaw to access sensitive credentials belonging to other teams. This could lead to data breaches, unauthorized system access, or privilege escalation within the Airflow environment.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could result in violations of GDPR's data protection principles or HIPAA's access control mandates, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade to apache-airflow-providers-google version 22.3.0 or later. Ensure all secrets are stored under team-scoped names using the <team>--<secret_id> convention. Disable multi-team mode if not required. Review and restrict access to Google Secret Manager.

Hi! I’m here to help you understand CVE-2026-68868. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70