CVE-2026-68076

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1

Description The environment-variable secrets backend incorrectly resolves team-scoped Connections or Variables from the wrong team's scope. This occurs because the security guard intended to prevent this behavior only executes when no team scope is provided and fails to match team names containing underscores. Consequently, the system performs an unconditional global read of the AIRFLOW CONN <TEAM> <ID> variable, regardless of the requesting team. In multi-team mode, an authenticated user can use the POST /api/v2/connections/test endpoint to resolve another team's Connection and authenticate outward using those credentials. Exploitation requires the [core] multi team setting to be enabled, [core] test connection to be set to Enabled, team-scoped secrets to be provisioned as environment variables in the API-server process, and knowledge of the encoded identifier.

Recommendations Upgrade to apache-airflow 3.3.1 or later.