71 matches found
EUVD-2026-57265
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...
PYSEC-2026-3714
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
PYSEC-2026-3714
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
CVE-2026-68868 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
CVE-2026-68868
The apache-airflow-providers-google package contains a vulnerability where the Google Cloud Secret Manager secrets backend fails to apply team scoping when resolving Connections and Variables . Although the caller's team_name is accepted, it is dropped at the internal call boundary, causing looku...
EUVD-2026-57163
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
PT-2026-80680
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team name was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnost...
CVE-2026-68868: Insufficient Granularity of Access Control
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's teamname was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti...
PT-2026-71048
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team name was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnost...
PT-2026-80677
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...
CVE-2026-65017: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...
PT-2026-71116
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...
CVE-2026-68971: Missing Authorization
Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...
PT-2026-71133
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description In deployments using multi-team mode with a team-aware auth manager, the asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until...
PT-2026-102298
Apache Airflow's asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until finished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a...
PT-2026-105491
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...