Severity: important 

Affected versions:

- Apache Airflow Google provider (apache-airflow-providers-google) before 22.3.0

Description:

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google 
provider never applied the team scope when resolving Connections and Variables: 
the caller's `team_name` was accepted by the backend but dropped at the 
internal call boundary, so every lookup resolved against the team-agnostic 
secret name. In a deployment running multi-team mode with this backend, a task 
or Dag belonging to one team resolved another team's Connection or Variable, 
obtaining its credentials in full. No unusual configuration is required beyond 
enabling multi-team mode and using this backend. Users are advised to upgrade 
to apache-airflow-providers-google 22.3.0 or later, which builds and applies 
the team-scoped secret name.

Credit:

Apache Airflow security team (finder)
Jarek Potiuk (remediation developer)

References:

https://github.com/apache/airflow/pull/70869
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-68868

Reply via email to