Read the docs
TI-2026-48427 Aliases CVE-2026-68868GHSA-qfr4-ppjq-9gr3

Apache Airflow Google provider: google Secret Manager backend: team scope is never…

Priority LOW 30CWE-1220Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Fixed Apache Airflow Google provider (Apache Software Foundation): 22.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow Google providerbefore 22.3.022.3.0Patch availableCNA
  • Apache Airflow Google provider VendorApache Affected before 22.3.0 Fixed in 22.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-google:*:*:*:*:*:*:*:*before 22.3.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-google:*:*:*:*:*:*:*:* Versions before 22.3.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow Google provider (Apache Software Foundation) Fixed in 22.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68868
  2. 2026-10-03 Alias added: GHSA-qfr4-ppjq-9gr3

References

Patch 1

Advisory 2

  • TI-2023-10968 Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution CVSS 3.1CRITICAL 9.8
  • TI-2023-10969 Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service CVSS 3.1HIGH 7.5
  • TI-2026-33152 Apache Airflow Google provider: SSH host key verification disabled in… CVSS 3.1HIGH 8.1
  • TI-2026-36483 Path traversal in Apache Airflow Google provider CVSS 3.1HIGH 8.1
  • TI-2026-56525 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences