CVE-2026-68868

Katalog CVE

CVSS 6.5 · Medium EPSS 0,60%

Kerentanan Insufficient Granularity of Access Control pada apache-airflow-providers-google. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1220: Insufficient Granularity of Access Control

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x mailing list · advisory vendor
• https://github.com/apache/airflow/pull/70869 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/08/12/3 mailing list · advisory pihak ketiga