Severity: moderate 

Affected versions:

- Apache Airflow Microsoft Azure provider 
(apache-airflow-providers-microsoft-azure) before 14.1.0

Description:

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure 
provider resolved a team-scoped Connection or Variable id through the 
team-agnostic lookup when the team-scoped lookup missed. In a deployment 
running multi-team mode with this backend, a caller in one team could resolve a 
secret belonging to another team by supplying an id that spells out that team's 
namespace, obtaining its credentials in full. No unusual configuration is 
required beyond enabling multi-team mode and using this backend. Users are 
advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, 
which refuses the team-agnostic fall-through for an id that could name a team 
namespace.

Credit:

Apache Airflow security team (finder)
Jarek Potiuk (remediation developer)

References:

https://github.com/apache/airflow/pull/70876
https://github.com/apache/airflow/pull/70899
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-68870

Reply via email to