Apache Airflow environment-variable secrets backend permits cross-team credential use

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

CVE-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

CVE-2026-68076: Authorization Bypass Through User-Controlled Key

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

PT-2026-80677

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

BIT-AIRFLOW-2026-32690 Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to...

CVE-2023-2247

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function...

CVE-2023-2247

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function...

CVE-2023-2247

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function...

CVE-2023-2247

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function...

CVE-2023-2247

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function...

PT-2023-18521 · Unknown · Octopus Deploy

Name of the Vulnerable Software and Affected Versions: Octopus Deploy affected versions not specified Description: The issue allows an attacker to unmask variable secrets using the variable preview function. Recommendations: At the moment, there is no information about a newer version that contai...

CVE-2023-2247

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function...

CVE-2023-2247

CVE-2023-2247 affects Octopus Deploy. The documented issue allows unmasking variable secrets via the variable preview feature in affected versions. The sources describe the behavior but do not specify exact affected versions or a confirmed patch. No exploitation details are provided in the docume...