CVE-2026-68870

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-microsoft-azure versions prior to 14.1.0

Description The Azure Key Vault secrets backend in the Microsoft Azure provider resolves a team-scoped Connection or Variable id using a team-agnostic lookup if the initial team-scoped lookup fails. In deployments utilizing multi-team mode, a user from one team can access secrets belonging to another team by providing an id that matches that team's namespace, allowing full retrieval of credentials.

Recommendations Upgrade to apache-airflow-providers-microsoft-azure version 14.1.0 or later.