EUVD-2026-57265
GHSA-75mg-c62r-v95g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Network-accessible API (AV:N) requires authenticated user (PR:L) and three non-default configuration prerequisites (AC:H); impact is unauthorized credential use (C:H) and lateral outbound authentication (I:L) with no availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3Blast Radius
ecosystem impact- 464 pypi packages depend on apache-airflow (431 direct, 37 indirect)
Ecosystem-wide dependent count for version 3.3.1.
DescriptionCVE.org
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored AIRFLOW_CONN__<TEAM>___<ID> variable regardless of which team asked. In multi-team mode an authenticated user of one team could therefore have POST /api/v2/connections/test resolve another team's Connection and authenticate outward with that team's credentials; the endpoint uses the credentials rather than returning them. Exploitation requires [core] multi_team enabled, [core] test_connection set to Enabled (it ships Disabled), team-scoped secrets provisioned as environment variables in the API-server process, and knowledge of the encoded identifier. Redirecting the test at an attacker-controlled host is separately blocked. Users are advised to upgrade to apache-airflow 3.3.1 or later.
AnalysisAI
Cross-team credential access in Apache Airflow before 3.3.1 allows authenticated members of one team to invoke another team's Connection credentials through the POST /api/v2/connections/test API endpoint, exploiting a broken namespace-isolation guard in the environment-variable secrets backend. The flaw-confirmed by Apache with patches in PRs #70736 and #70902-combines a guard that only triggered on unscoped (global) requests with a regex incapable of matching team names containing underscores, even though underscores are explicitly permitted in Airflow team name validation. Exploitation requires a precise configuration alignment of multi_team mode, an explicitly enabled test_connection endpoint, and environment-variable-provisioned team secrets; no public exploit has been identified at time of analysis.
Technical ContextAI
The EnvironmentVariablesBackend class in airflow-core/src/airflow/secrets/environment_variables.py namespaces team-scoped secrets using the convention AIRFLOW_CONN__<TEAM>___<SECRET_ID>. The pre-patch guard method _is_team_specific_accessed_as_global(secret_id, team_name) had two independent defects captured by CWE-639 (Authorization Bypass Through User-Controlled Key): first, the method only executed when team_name was None, meaning authenticated users who supplied their own team scope as a parameter bypassed the check entirely; second, the guard's regex r"_[^_]+___.+" excluded underscores from the team-name segment via [^_]+, yet Airflow validates team names against ^[a-zA-Z0-9_-]{3,50}$, explicitly allowing underscores. When either condition caused the guard to not apply, lookup fell through to an unconditional global environment variable read that resolved AIRFLOW_CONN__<OTHER_TEAM>___<ID> regardless of which team initiated the request. CPE cpe:2.3:a:apache_software_foundation:apache_airflow:*:*:*:*:*:*:*:* identifies the full affected product line. The fix in PR #70736 replaces the broken guard with _names_a_team_namespace(secret_id), which runs unconditionally on every lookup and uses the corrected regex r"_.+___.+" to block any identifier that spells out a team-namespace pattern, with a second PR #70902 completing the fix.
RemediationAI
Upgrade to apache-airflow 3.3.1 or later, which delivers the corrected namespace-isolation logic from upstream PRs #70736 (https://github.com/apache/airflow/pull/70736) and #70902 (https://github.com/apache/airflow/pull/70902) as documented in the Apache advisory at https://lists.apache.org/thread/v4mc51dgmrc1t82mhzsngsgzo2gxsf2l. As an immediate compensating control requiring no restart of DAG workers, set test_connection = Disabled under the [core] section in airflow.cfg-this is already the factory default and eliminates the POST /api/v2/connections/test endpoint entirely; connection testing is a developer convenience and is not invoked at DAG runtime, so disabling it carries no workflow execution impact. Operators may also migrate team-scoped secrets from environment variables to a different backend such as the Airflow database backend or HashiCorp Vault, which removes the vulnerable EnvironmentVariablesBackend code path without requiring an immediate version upgrade; note that migrating secrets backends requires re-provisioning all existing team Connections and Variables in the new backend. Restricting API access to the connections/test endpoint via API gateway ACL or network policy provides defense depth but is not a substitute for patching, as the restriction must be applied per-team and is operationally fragile.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today