CVE-2026-68872
Received Received - Intake

AWS Systems Manager Secrets Manager Credential Exposure in Apache Airflow

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Apache Software Foundation

Description
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68872
EUVD
EUVD-2026-55701

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache airflow_providers_amazon 9.34.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Apache Airflow's Amazon provider when using AWS Systems Manager Parameter Store or Secrets Manager backends in multi-team mode. It allows a caller in one team to access secrets belonging to another team by exploiting a fallback mechanism that incorrectly resolves team-scoped identifiers.

Detection Guidance

This vulnerability affects Apache Airflow's Amazon provider in multi-team mode when using AWS Systems Manager Parameter Store or Secrets Manager backends. Detection requires checking the installed version of apache-airflow-providers-amazon. If it is below 9.34.0, the system is vulnerable. No specific commands are provided in the context to detect this issue.

Impact Analysis

If you use Apache Airflow in multi-team mode with AWS Parameter Store or Secrets Manager, an attacker within your environment could access sensitive credentials belonging to other teams. This could lead to unauthorized data access or privilege escalation within your deployment.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data across teams. GDPR and HIPAA require strict data isolation and access controls, which this flaw undermines by allowing cross-team credential exposure.

Mitigation Strategies

Upgrade to apache-airflow-providers-amazon version 9.34.0 or later to prevent team-agnostic lookups from resolving team-scoped secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart