Apache Airflow Microsoft Azure Provider
Monthly
Cross-team credential disclosure in the Apache Airflow Microsoft Azure provider's Key Vault secrets backend allows any authenticated team member to read credentials belonging to a different team in multi-team deployments running versions prior to 14.1.0. The backend's team-scoped lookup falls through to a team-agnostic resolution when the scoped lookup misses, and an attacker in one team can deliberately trigger this by supplying a connection or variable ID whose normalized form encodes the target team's namespace prefix. No public exploit has been identified at time of analysis, but the attack primitive is directly derivable from the published patch diff, making this a credible insider-privilege escalation risk for any organization using this backend in multi-team mode.
Cross-team credential disclosure in the Apache Airflow Microsoft Azure provider's Key Vault secrets backend allows any authenticated team member to read credentials belonging to a different team in multi-team deployments running versions prior to 14.1.0. The backend's team-scoped lookup falls through to a team-agnostic resolution when the scoped lookup misses, and an attacker in one team can deliberately trigger this by supplying a connection or variable ID whose normalized form encodes the target team's namespace prefix. No public exploit has been identified at time of analysis, but the attack primitive is directly derivable from the published patch diff, making this a credible insider-privilege escalation risk for any organization using this backend in multi-team mode.