CVE-2026-68868: Apache Airflow Google Provider Secrets Backend Team Scope Bypass Vulnerability
Summary
CVE-2026-68868: The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team_name was accepted by the backend but dropped at... Affects apache-airflow-providers-google versions < 22.3.0. Fixed in 22.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. The Google provider for Apache Airflow allows users to interact with Google Cloud services, including the management of secrets through the Google Cloud Secret Manager. This provider is crucial for securely handling sensitive information such as API keys and credentials. However, a vulnerability in this provider's implementation can lead to unauthorized access to sensitive data across different teams in a multi-team environment.
Vulnerability Detail
The vulnerability arises from the Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider, which fails to apply the team scope when resolving Connections and Variables. Although the caller's team name is accepted, it is disregarded at the internal call boundary, leading to a situation where tasks or DAGs belonging to one team can access another team's Connection or Variable. This flaw can result in unauthorized credential exposure, posing a significant security risk in deployments that operate in multi-team mode.
How To Fix
Latest published version: 22.7.0 as of 23 Oct 2026
pip install --upgrade "apache-airflow-providers-google==22.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
22.3.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow-providers-google==22.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as described in the 'how_to_fix' section.
Conclusion
The CVE-2026-68868 vulnerability in the Apache Airflow Google provider poses a serious risk in multi-team environments by allowing unauthorized access to sensitive credentials. Users are strongly advised to upgrade to the latest version to protect their applications from potential data breaches.
See every vulnerability recorded for apache-airflow-providers-google →
FAQ
CVE-2026-68868 is a vulnerability in the Apache Airflow Google provider that allows unauthorized access to sensitive information across different teams due to a failure in applying team scope.
If your application uses the Apache Airflow Google provider in a multi-team setup, this vulnerability could allow one team to access another team's credentials, leading to potential data breaches.
If you are using an affected version of the apache-airflow-providers-google package, you should upgrade to version 22.3.0 or later immediately to mitigate the risk.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the Pipfile.lock, providing an easy way to stay informed about potential security issues.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow-providers-google.
