CVE-2026-68076
CVE-2026-68076: 1 tracked advisory record across Apache. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityMedium5.4
Medium [CVE-2026-68076] Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection
CVE-2026-68076Source published Source updated
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN_____` variable regardless of which team asked. In multi-team mode an authenticated user of one team could therefore have `POST /api/v2/connections/test` resolve another team's Connection and authenticate outward with that team's credentials; the endpoint uses the credentials rather than returning them. Exploitation requires `[core] multi_team` enabled…
- Affected products in this advisory
- Apache Airflow
- Source-reported affected versions
- Apache Airflow before 3.3.1
- Source-reported fixed versions
- 3.3.1
- Mitigation guidance
- When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN_____` variable regardless of which team asked.
- Users are advised to upgrade to apache-airflow 3.3.1 or later.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.