CVE-2026-68872: Apache Airflow Auth Bypass Vulnerability

CVE-2026-68872 Overview

CVE-2026-68872 affects the Apache Airflow Amazon provider's AWS Systems Manager Parameter Store and Secrets Manager backends. The vulnerability allows a caller in one team to read secrets belonging to another team when Airflow runs in multi-team mode. The backends fall through to a team-agnostic lookup after a team-scoped lookup misses, resolving Connection or Variable identifiers that name another team's namespace. An authenticated user in one team can obtain full credentials from another team by crafting an appropriate id. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated tenant in an Airflow multi-team deployment can retrieve another team's AWS-stored Connections and Variables, exposing credentials across tenant boundaries.

Affected Products

Apache Airflow apache-airflow-providers-amazon releases prior to 9.34.0
Deployments using the AWS Systems Manager Parameter Store secrets backend
Deployments using the AWS Secrets Manager secrets backend

Discovery Timeline

2026-08-10 - CVE-2026-68872 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68872

Vulnerability Analysis

Apache Airflow supports multi-team mode, isolating Connections and Variables between tenants. Secret backends built on AWS Systems Manager Parameter Store and AWS Secrets Manager perform a team-scoped lookup first, then fall back to a team-agnostic lookup when the scoped lookup returns nothing. The fallback ignores the caller's team boundary and resolves any id that spells out another team's namespace path. A user in Team A can request an id shaped like Team B's namespace and receive Team B's credential material. The impact is confidentiality loss for stored Connections and Variables, including AWS keys, database passwords, and API tokens referenced from Airflow DAGs.

Root Cause

The backends treat the id parameter as an opaque lookup key and use a permissive fallback path. The team-agnostic fall-through does not verify that a supplied id belongs to the caller's namespace before resolving it. This is a classic authorization bypass through a user-controlled key, where the identifier itself grants cross-tenant access.

Attack Vector

The attacker must be an authenticated Airflow user with permission to define or execute a DAG that references a Connection or Variable id. No unusual configuration is required beyond enabling multi-team mode and one of the two AWS backends. The attacker supplies an id that encodes another team's namespace path. The backend's fallback resolves it and returns the target team's stored secret value in full. The vulnerability manifests entirely inside the provider's secrets lookup logic. Refer to the GitHub Pull Request for the code-level fix and lookup path details.

Detection Methods for CVE-2026-68872

Indicators of Compromise

Airflow task logs containing Connection or Variable ids that reference namespaces outside the executing team's scope
CloudTrail GetParameter, GetParameters, or GetSecretValue calls from the Airflow worker role targeting parameter names or secret ids that belong to another team's namespace
Unexpected DAG code introducing string-constructed ids that mirror another team's naming convention

Detection Strategies

Correlate Airflow audit logs of Connection and Variable resolutions with the executing team context and alert on mismatches
Baseline AWS CloudTrail activity from Airflow execution roles per team and flag reads that cross namespace prefixes
Review DAG source control for commits that introduce dynamically constructed secret ids or hardcoded cross-team namespace strings

Monitoring Recommendations

Enable CloudTrail data events for the specific Parameter Store paths and Secrets Manager ARNs used by Airflow
Forward Airflow scheduler and worker logs to a centralized SIEM for cross-team correlation
Alert on any successful secret resolution where the resolved id's namespace prefix does not match the invoking team

How to Mitigate CVE-2026-68872

Immediate Actions Required

Upgrade apache-airflow-providers-amazon to version 9.34.0 or later, which refuses the team-agnostic fall-through for ids that could name a team namespace
Rotate all AWS-stored Connections and Variables that may have been accessible during the exposure window
Audit CloudTrail history for cross-team GetParameter and GetSecretValue calls originating from Airflow roles

Patch Information

The fix is delivered in apache-airflow-providers-amazon 9.34.0. The change rejects team-agnostic fallback lookups when the supplied id could resolve to another team's namespace. Details are available in the Apache Mailing List Discussion and the Openwall OSS Security Announcement.

Workarounds

Disable multi-team mode until the provider can be upgraded if operationally feasible
Switch to a secrets backend not affected by this fall-through behavior until patching is complete
Restrict the IAM policy attached to Airflow worker roles so each team's role can only read its own namespace prefix in Parameter Store or Secrets Manager

bash

# Upgrade the affected provider
pip install --upgrade 'apache-airflow-providers-amazon>=9.34.0'

# Verify installed version
pip show apache-airflow-providers-amazon | grep Version