Skip to content
OpenAdvisories
Medium WID-SEC-2026-2733 3 CVEs

Apache Airflow Provider: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Aug 10, 2026 · Updated Aug 10, 2026 · de-DE

Vendor: Apache Product: Airflow

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Informationen offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-68871

    Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

    The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in…

    Apache Software Foundation Apache Airflow Yandex provider apache-airflow-providers-yandex PyPI
  • Medium 6.5
    CVE-2026-68872

    Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

    The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team m…

    Apache Software Foundation Apache Airflow Amazon provider apache-airflow-providers-amazon PyPI
  • Medium 5.3
    CVE-2026-68870

    Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

    The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a…

    Apache Software Foundation Apache Airflow Microsoft Azure provider

Revision history

  1. #1

    Initiale Fassung

References