CVE-2026-68870 Overview
CVE-2026-68870 affects the Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider. When a team-scoped Connection or Variable lookup missed, the backend fell through to a team-agnostic lookup. A caller operating in one team could then supply an id that named another team's namespace and receive that team's credentials in full. The flaw only surfaces in deployments running multi-team mode with the Azure Key Vault backend enabled. It is tracked under CWE-639: Authorization Bypass Through User-Controlled Key. Users should upgrade to apache-airflow-providers-microsoft-azure14.1.0 or later.
Critical Impact
A caller in one team can read secrets belonging to another team, obtaining that team's credentials in full without special configuration beyond multi-team mode.
Affected Products
- Apache Airflow Microsoft Azure provider (apache-airflow-providers-microsoft-azure) versions prior to 14.1.0
- Apache Airflow deployments running in multi-team mode
- Deployments using Azure Key Vault as the secrets backend
Discovery Timeline
- 2026-08-10 - CVE-2026-68870 published to NVD
- 2026-08-10 - Public disclosure on OpenWall OSS Security
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-68870
Vulnerability Analysis
Apache Airflow's multi-team mode isolates Connections and Variables by team namespace. The Azure Key Vault secrets backend implements this isolation by first querying a team-scoped key. On a miss, the backend fell back to a team-agnostic lookup that ignored the caller's team boundary. An attacker with legitimate access to one team could construct an id that spells out another team's namespace. The backend then returned the target team's secret to the requester, breaking tenant isolation.
The issue is a broken access control flaw in the resolution path, not a flaw in Azure Key Vault itself. Any credential material stored under another team's namespace, including database passwords, API keys, and cloud credentials, becomes reachable through this fall-through.
Root Cause
The root cause is authorization bypass through a user-controlled key [CWE-639]. The secrets backend accepted a caller-supplied id and used it to key a secondary lookup that lacked team-scoping enforcement. The fall-through logic assumed a missed team-scoped lookup indicated a global secret, but the id itself could name a foreign team's namespace. The fix in 14.1.0 refuses the team-agnostic fall-through when the supplied id could name a team namespace.
Attack Vector
Exploitation requires an authenticated principal in an Airflow deployment that runs multi-team mode with the Azure Key Vault backend. The attacker issues a Connection or Variable resolution request using an id crafted to reference another team's namespace. The team-scoped lookup misses because the caller does not own that namespace. The backend then falls through and returns the target team's secret. No unusual configuration or elevated privileges are needed beyond legitimate team membership.
For technical detail on the code path and the fix, refer to Apache Airflow Pull Request #70876 and Pull Request #70899.
Detection Methods for CVE-2026-68870
Indicators of Compromise
- Airflow secrets backend logs showing Connection or Variable lookups where the requested id references a team namespace not owned by the requesting caller.
- Azure Key Vault access logs showing secret reads correlated with Airflow worker or scheduler activity outside the caller's team scope.
- Unexpected use of credentials belonging to one team by DAGs, tasks, or API calls originating in another team.
Detection Strategies
- Audit Airflow task logs and API access records for Connection/Variable id patterns that embed foreign team namespaces.
- Correlate Azure Key Vault SecretGet events with the Airflow team context of the requesting workload.
- Baseline expected secret access per team and alert on cross-team reads from the Azure Key Vault backend.
Monitoring Recommendations
- Enable Azure Key Vault diagnostic logging and forward events to a centralized analytics platform for correlation with Airflow audit data.
- Monitor DAG runs that reference Connections or Variables outside their declared team namespace.
- Track version inventory of apache-airflow-providers-microsoft-azure across all Airflow deployments to identify unpatched instances.
How to Mitigate CVE-2026-68870
Immediate Actions Required
- Upgrade apache-airflow-providers-microsoft-azure to version 14.1.0 or later on every Airflow scheduler, worker, and triggerer host.
- Rotate any Azure Key Vault-backed Connection and Variable secrets that may have been exposed to other teams during the vulnerable window.
- Review Airflow audit logs and Azure Key Vault access logs for cross-team secret reads prior to the upgrade.
Patch Information
The upstream fix landed in apache-airflow-providers-microsoft-azure14.1.0. The patched backend refuses the team-agnostic fall-through when the supplied id could name a team namespace. Fix details are available in GitHub Pull Request #70876, Pull Request #70899, and the Apache Mailing List Thread.
Workarounds
- Disable multi-team mode until the provider can be upgraded, if operationally feasible.
- Switch to a different secrets backend that enforces team-scoping correctly until the Azure Key Vault backend is patched.
- Restrict Airflow API and UI access so that only trusted operators can submit Connection or Variable ids referencing arbitrary namespaces.
# Upgrade the affected provider package
pip install --upgrade "apache-airflow-providers-microsoft-azure>=14.1.0"
# Verify the installed version
pip show apache-airflow-providers-microsoft-azure | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
