{"id":"CVE-2026-68870","title":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed","summary":"The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mod…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-639"],"vendor":"Apache Software Foundation","product":"apache-airflow-providers-microsoft-azure","affected":["apache-airflow-providers-microsoft-azure < 14.1.0"],"published":"2026-08-10","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:17:41.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68870","references":[{"url":"https://github.com/apache/airflow/pull/70876","label":"security@apache.org"},{"url":"https://github.com/apache/airflow/pull/70899","label":"security@apache.org"},{"url":"https://lists.apache.org/thread/dtkk6vtfoj1y4zjyd6s3mzg0v5g9yg0p","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/10/4","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-12T15:44:21.767006Z"},"epss":0.00225,"epssPercentile":0.13386,"ingestedAt":"2026-09-16T15:58:38.716Z","slug":"CVE-2026-68870","body":"## Overview\n\nThe Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-microsoft-azure 14.1.0 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}