Vulnerability Details CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 31.6%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-68868
-
cpe:2.3:a:apache:apache-airflow-providers-google:1.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:1.3.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.11.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.11.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.12.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.13.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.13.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.14.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.15.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.16.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.17.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.18.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.19.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.20.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.21.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.21.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.22.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.23.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.24.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.25.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.26.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:11.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:12.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:14.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:14.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:15.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:15.0.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:15.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:16.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:16.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:17.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:17.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:17.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:18.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:18.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:20.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:22.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:22.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:22.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:22.2.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:22.2.2
-
cpe:2.3:a:apache:apache-airflow-providers-google:3.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:4.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:4.1.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:5.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:5.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.8.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:7.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.10.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.11.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.12.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.8.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.9.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:9.0.0