CVE-2026-68076: Apache Airflow Connection Test API Team-Scope Guard Bypass Vulnerability
Summary
CVE-2026-68076: Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. Affects airflow versions < 3.3.1. Fixed in 3.3.1. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2026-68076 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to manage complex data pipelines and automate tasks across various systems. The platform supports multi-team environments, enabling different teams to manage their connections and variables securely. However, a vulnerability exists in the way Airflow handles team-scoped connections, which can lead to unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from a flaw in Apache Airflow's environment-variable secrets backend, where the guard meant to restrict access to team-scoped Connections or Variables fails to function correctly. This occurs when no team scope is supplied, and the guard's pattern does not match team names containing underscores. As a result, an authenticated user from one team can exploit the API endpoint '/api/v2/connections/test' to access another team's Connection and authenticate using that team's credentials. This poses a significant security risk in multi-team setups, allowing unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While a direct workaround is not specified, users are advised to disable the '[core] test_connection' feature until they can upgrade to the patched version. This can be done by modifying the Airflow configuration file (airflow.cfg) and setting 'test_connection = Disabled' under the [core] section.
Conclusion
CVE-2026-68076 represents a significant security vulnerability in Apache Airflow that can lead to unauthorized access to sensitive connections in multi-team environments. Users are strongly encouraged to upgrade to version 3.3.1 or later to mitigate this risk. Additionally, disabling the test connection feature can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-68076 is a vulnerability in Apache Airflow that allows an authenticated user from one team to access another team's connections due to a flaw in the team-scope guard.
If you are using Apache Airflow version prior to 3.3.1, your installation is vulnerable to CVE-2026-68076.
An attacker could gain unauthorized access to another team's connections and credentials, leading to potential data breaches and unauthorized actions within the system.
Yes, you can disable the '[core] test_connection' feature in your Airflow configuration until you are able to upgrade to the patched version.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can also check if your application is affected by vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
