MEDIUMPyPI

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team'

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardless of which team asked. In m

CVE-2026-68076Published 2 weeks agoUpdated 1 week agoSource: OSV

Affected packages

  • apache-airflowbefore 3.3.1

Exploit signal

Known exploited (CISA KEV)
No
EPSS score
EPSS percentile

EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team' | HackTribune