Improper access control in Apache Airflow - CVE-2026-68076
Published: August 24, 2026
Vulnerability details
The vulnerability allows a remote user to cause the application to authenticate outward using another team's connection credentials.
The vulnerability exists due to improper access control in the connections test API and environment-variable secrets backend when handling a connection test request in multi-team mode. A remote user can send a specially crafted request referencing another team's encoded connection identifier to cause the application to authenticate outward using another team's connection credentials.
Exploitation requires multi-team mode enabled, connection testing enabled, team-scoped secrets provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. The endpoint uses the credentials rather than returning them.