CVE-2026-68872: Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using one of these backends. Users are advised to upgrade to apache-airflow-providers-amazon 9.34.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-amazonto a version that resolves this vulnerability.Fixed in 9.34.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68872?
The severity of CVE-2026-68872 is rated at 62 on the risk scale.
How does CVE-2026-68872 affect Apache Airflow?
CVE-2026-68872 allows a team to access another team's Connection or Variable due to a guard bypass in the Amazon SSM and Secrets Manager backends.
How can I mitigate CVE-2026-68872 in my deployment?
To mitigate CVE-2026-68872, ensure that team-scoped lookups are properly configured and validated to prevent unauthorized access.
What versions of Apache Airflow are affected by CVE-2026-68872?
CVE-2026-68872 affects deployments running the Apache Airflow Amazon provider that employ team-scoped Connections or Variables.
What should I do if I am running a vulnerable version of Apache Airflow related to CVE-2026-68872?
If you are running a vulnerable version, it is recommended to update to the latest version that addresses CVE-2026-68872.