{"id":"CVE-2026-68870","aliases":["EUVD-2026-55695","GHSA-6hj8-q7v2-996c"],"status":"published","title":"Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable","description":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00363,"percentile":0.30432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-08-10T18:10:33Z","modified":"2026-10-28T02:30:56Z","products":[{"vendor":"apache software foundation","product":"apache airflow microsoft azure provider"}],"references":[{"url":"https://github.com/apache/airflow/pull/70876","tags":["patch","fix"]},{"url":"https://github.com/apache/airflow/pull/70899","tags":["patch","fix"]},{"url":"https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p","tags":["vendor-advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/10/4","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6hj8-q7v2-996c"},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68870.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-68870","title":"Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable","description":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.","status":"published","published":"2026-08-10T18:10:33.022Z","modified":"2026-09-16T14:56:18.601Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:46:10.323375Z"}],"euvd":[{"id":"EUVD-2026-55695","description":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.","status":"published","published":"2026-08-10T18:10:33Z","modified":"2026-09-16T14:56:18Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:15.854171Z"}],"ghsa":[{"id":"GHSA-6hj8-q7v2-996c","title":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team...","description":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.","status":"published","published":"2026-08-10T21:32:03Z","modified":"2026-08-12T18:32:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:10:23.360888Z"}],"nvd":[{"id":"CVE-2026-68870","description":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.","status":"published","published":"2026-08-10T19:17:30.337Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:36.102748Z"}],"osv":[{"id":"CVE-2026-68870","title":"Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable","description":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.","status":"published","published":"2026-08-10T18:10:33.022Z","modified":"2026-10-28T02:30:56.348839658Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:45:14.808935Z"}]}}