CVE-2026-68076: Apache Airflow Auth Bypass Vulnerability

CVE-2026-68076 Overview

CVE-2026-68076 is a broken access control flaw in Apache Airflow's environment-variable secrets backend. The backend resolves a team-scoped Connection or Variable from the wrong team's scope when running in multi-team mode. A guard designed to block cross-team lookups only executed when no team scope was supplied. Its regular expression also failed to match team names containing underscores, which Airflow permits. When the guard did not apply, the lookup fell through to an unconditional global read that returned any AIRFLOW_CONN__<TEAM>___<ID> variable regardless of the requesting team. Apache Airflow 3.3.1 resolves the issue.

Critical Impact
An authenticated user in one team can invoke POST /api/v2/connections/test and cause the API server to authenticate outward using another team's stored credentials.

Affected Products

Apache Airflow multi-team deployments prior to 3.3.1
Deployments with [core] test_connection set to Enabled (ships Disabled)
API-server processes with team-scoped secrets provisioned as environment variables

Discovery Timeline

2026-08-12 - CVE-2026-68076 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68076

Vulnerability Analysis

Apache Airflow supports a multi-team deployment mode where Connection and Variable objects are scoped to a team. The environment-variable secrets backend encodes these as AIRFLOW_CONN__<TEAM>___<ID> process environment variables in the API-server. When a lookup arrives with a team scope, the backend is expected to enforce that the resolved secret belongs to the requesting team.

The enforcement guard only executed on lookups where the caller supplied no team scope. It also relied on a pattern that could not match team names containing underscores, which Airflow explicitly allows. Both conditions produced code paths where the guard was skipped entirely.

When the guard did not apply, the lookup fell through to an unconditional global read across all environment variables. The backend returned the first matching AIRFLOW_CONN__<TEAM>___<ID> regardless of which team requested it. Because the flaw is a scoping error rather than credential disclosure, the classification maps to [CWE-639] Authorization Bypass Through User-Controlled Key.

Root Cause

The root cause is an incomplete cross-tenant authorization check in the environment-variable secrets backend. The guard's conditional execution and its underscore-blind regular expression produced a fail-open behavior that resolved another team's secret through a global environment scan.

Attack Vector

Exploitation requires an authenticated user in a multi-team Airflow deployment with several preconditions satisfied. [core] multi_team must be enabled, [core] test_connection must be set to Enabled, target team secrets must be provisioned as environment variables in the API-server process, and the attacker must know the encoded connection identifier. The attacker sends POST /api/v2/connections/test referencing another team's connection. The API server resolves the wrong team's credentials and authenticates outward to the connection target. The endpoint uses the credentials rather than returning them, and redirecting the test at an attacker-controlled host is separately blocked.

See the GitHub Pull Request #70736 and GitHub Pull Request #70902 for the corrective changes.

Detection Methods for CVE-2026-68076

Indicators of Compromise

POST /api/v2/connections/test requests referencing connection identifiers that belong to a team other than the authenticated user's team.
Outbound authentication attempts from the Airflow API server to systems that the requesting team does not normally access.
Repeated connection-test requests enumerating candidate encoded identifiers.

Detection Strategies

Correlate API-server access logs for /api/v2/connections/test with the authenticated user's team membership and flag mismatches against the target connection's owning team.
Compare outbound destination systems from Airflow workers and the API server against a baseline of expected per-team endpoints.
Alert on requests from users whose team name contains an underscore, since these previously bypassed the guard.

Monitoring Recommendations

Enable audit logging on the Airflow REST API and forward events to a SIEM for correlation with identity context.
Monitor process environment provisioning changes on the API server to track which AIRFLOW_CONN__* variables are exposed.
Track version drift so any host running a pre-3.3.1 Airflow release surfaces immediately.

How to Mitigate CVE-2026-68076

Immediate Actions Required

Upgrade Apache Airflow to version 3.3.1 or later on all API-server, scheduler, and worker hosts.
Set [core] test_connection to Disabled until the upgrade completes.
Rotate credentials for any team-scoped connection stored as an environment variable on affected API-server hosts.

Patch Information

The fix is included in apache-airflow 3.3.1. The relevant changes are documented in GitHub Pull Request #70736, GitHub Pull Request #70902, the Apache Mailing List Thread, and the Openwall OSS Security Update.

Workarounds

Disable the connection-test endpoint by setting [core] test_connection to Disabled in airflow.cfg.
Migrate team-scoped secrets out of process environment variables into a secrets backend that enforces per-team access controls.
Rename teams to remove underscores where operationally feasible until the upgrade is applied.

bash

# airflow.cfg mitigation
[core]
multi_team = True
test_connection = Disabled