CVE-2026-68868Medium· 6.5▾ SunlitThe Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
Last analysed / modified upstream
0.6% → 0.6%
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team_name was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
apache-airflow-providers-google < 22.3.0Upgrade past the affected range:
apache-airflow-providers-google 22.3.0Affected packages:
apache-airflow-providers-google < 22.3.0Patched in:
apache-airflow-providers-google 22.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81914Medium· 4.3Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them
CVE-2023-25691Critical· 9.8Apache Airflow Google Provider Improper Input Validation vulnerability
CVE-2026-45361High· 8.1Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an A…
CVE-2026-49297High· 8.1Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by…
CVE-2023-25692High· 7.5Apache Airflow Google Provider Improper Input Validation vulnerability
CVE-2026-81930Medium· 6.3Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs