Executive brief
Apache Airflow is a workflow orchestration platform used to schedule and monitor data pipelines. In multi-team deployments with specific security settings enabled, an authenticated user from one team could potentially access another team's database credentials by exploiting a flaw in the secrets backend. An attacker could use these credentials to authenticate outward as the compromised team, potentially gaining unauthorized access to downstream systems.
Technical details
The vulnerability is an authorization bypass in Apache Airflow's environment-variable secrets backend that fails to properly enforce team-scoped access control. The guard mechanism intended to prevent cross-team secret resolution only runs when no team scope is supplied, and its pattern cannot match team names containing underscores (which are permitted). When the guard does not apply, the lookup falls through to an unconditional global read of `AIRFLOW_CONN__<TEAM>___<ID>` environment variables. An authenticated user in one team can send a POST request to `/api/v2/connections/test` with a crafted connection identifier to resolve and test another team's Connection, using the resolved credentials for authentication. Exploitation requires [core] multi_team enabled, [core] test_connection set to Enabled (shipped as Disabled), team-scoped secrets provisioned as environment variables, and knowledge of the encoded identifier. The fix is available in Apache Airflow 3.3.1 and later.
Affected products
- Apache Airflow before 3.3.1
Timeline
- 2026-08-12: disclosed
- 2026-08-01: patched: Fix merged to main branch; released in version 3.3.1