CVE-2026-68076
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Apache Airflow, the environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore. In multi-team mode an authenticated user of one team could resolve another team's Connection and authenticate outward with that team's credentials.
Risk Assessment
Risk of unauthorized access to another team's credentials, potentially leading to confidentiality and integrity breaches in a multi-team environment.
Recommendation
Upgrade to Apache Airflow 3.3.1 or later and ensure the connection testing feature is disabled if not required.
Other vulnerabilities in Apache Airflow
See all- CVE-2025-68438High
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of those fields used a secrets masker instance that did not include user-registered mask_secret() patterns, so secrets were not reliably masked before truncation and display. Users are recommended to upgrade to 3.1.6 or later, which fixes this issue.
- CVE-2026-86473Critical
In Apache Airflow, the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out by presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires (default lifetime 24 hours, configurable).
- CVE-2026-33264Critical
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG. A DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary.
- CVE-2026-42252Critical
Apache Airflow documentation contained a `BashOperator` code example without proper quoting, allowing shell metacharacter injection via the `conf` field in the DAG trigger API. An authenticated user with `Dag.can_trigger` permission could execute arbitrary commands on the worker.
- CVE-2020-13927CriticalActively exploited
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
- CVE-2020-11978HighActively exploited
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
- CVE-2026-82355Medium
In Apache Airflow 3.3.0 and 3.3.1, there is an authentication precedence issue: when a request carries both a session cookie and an explicit Bearer token, Airflow resolves the caller from the cookie and ignores the token. This causes the request to execute as the cookie's principal rather than the token identity, leading to misattributed audit records.
- CVE-2026-75158Medium
The /assets/events API in Apache Airflow returns asset events for all DAGs without filtering according to the caller's permissions. Any authenticated user with asset-read access can enumerate events, including source DAG IDs, task IDs, run IDs, and timestamps, for DAGs they are not authorized to see. Even the total_entries and pagination disclose the existence of hidden DAGs.
- CVE-2026-75157High
Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could delete that Dag's queued asset events, silently suppressing asset-triggered scheduling.
- CVE-2026-68971Medium
In Apache Airflow, the asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. In multi-team mode with a team-aware auth manager, an authenticated user in one team could trigger Dag runs belonging to another team, supplying their own `dag_run_id` and `conf`, and could read another team's XCom values. Deployments using the FAB auth manager are unaffected. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Original NVD description (English source)
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardless of which team asked. In multi-team mode an authenticated user of one team could therefore have `POST /api/v2/connections/test` resolve another team's Connection and authenticate outward with that team's credentials; the endpoint uses the credentials rather than returning them. Exploitation requires `[core] multi_team` enabled, `[core] test_connection` set to `Enabled` (it ships `Disabled`), team-scoped secrets provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. Redirecting the test at an attacker-controlled host is separately blocked. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS