Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-68868 EUVD-2026-57163GHSA-qfr4-ppjq-9gr3PYSEC-2026-3714

Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

Published Aug 12, 2026 · Updated Sep 16, 2026 · Assigned by apache

Description

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow Google provider < 22.3.0 22.3.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow-providers-google < 22.3.0 22.3.0 PYSEC-2026-3714

Advisories 1

References