CVE-2026-68870

Received Received - Intake

Microsoft Azure Provider Secret Exposure in Apache Airflow

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Apache Software Foundation

Description

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-68870

EUVD

EUVD-2026-55695

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache_airflow_providers_microsoft_azure	14.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability involves Apache Airflow's Microsoft Azure provider where a team-scoped secret could be accessed by another team due to a flawed lookup mechanism. When multi-team mode is enabled and the team-specific lookup fails, the system falls back to a team-agnostic lookup, allowing unauthorized access to secrets belonging to other teams.

Detection Guidance

This vulnerability can be detected by checking the version of the Apache Airflow Microsoft Azure provider. If you are running multi-team mode with the affected backend, verify if the version is below 14.1.0. Commands like 'pip show apache-airflow-providers-microsoft-azure' or checking your package manager can confirm the version.

Impact Analysis

If you use Apache Airflow in multi-team mode with the Azure Key Vault secrets backend, an attacker within one team could exploit this to access secrets and credentials of another team. This could lead to unauthorized data access, credential theft, or further compromise of systems relying on those secrets.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected configurations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade the Apache Airflow Microsoft Azure provider to version 14.1.0 or later. Disable multi-team mode if not required or ensure proper access controls are in place to prevent unauthorized secret access across teams.

Hi! I’m here to help you understand CVE-2026-68870. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70