CVE-2026-68868

{
  "id": "CVE-2026-68868",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T11:17:10.063",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name."
    },
    {
      "lang": "es",
      "value": "El backend de secretos de Google Cloud Secret Manager en el proveedor de Google de Apache Airflow nunca aplicó el alcance de equipo al resolver Conexiones y Variables: el ’team_name’ del llamador fue aceptado por el backend pero se descartó en el límite de la llamada interna, por lo que cada búsqueda se resolvió contra el nombre de secreto agnóstico al equipo. En una implementación que ejecuta el modo multi-equipo con este backend, una tarea o Dag perteneciente a un equipo resolvió la Conexión o Variable de otro equipo, obteniendo sus credenciales completas. No se requiere ninguna configuración inusual más allá de habilitar el modo multi-equipo y usar este backend. Se aconseja a los usuarios actualizar a apache-airflow-providers-google 22.3.0 o posterior, que construye y aplica el nombre de secreto con alcance de equipo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow Google provider",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow-providers-google",
          "packageURL": "pkg:pypi/apache-airflow-providers-google",
          "versions": [
            {
              "version": "0",
              "lessThan": "22.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T17:13:36.353116Z",
          "id": "CVE-2026-68868",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1220"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-google:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "22.3.0",
              "matchCriteriaId": "83F66DF9-D6DD-4616-B438-C7AFAA6E6E0A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/70869",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/03h5y0fmqlh0yf055zlocxh591ozx69x",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/08/12/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}