CVE-2026-68076: Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the w

Routine

MEDIUM 5.4WATCHLISTUPGRADE

CVE-2026-68076 is a medium-severity flaw (CVSS 5.4) affecting airflow. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are allowed to contain. When the guard did not apply, the lookup fell through to an unconditional global read that resolved the stored `AIRFLOW_CONN__<TEAM>___<

Why this priority

On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 73%)
CISA exploited list	No
Weakness	CWE-639
Published	2026-08-12
Last modified	2026-10-24

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-08-12 16:17 UTCPublished CVE record published
2026-10-24 16:10 UTCUpdated Record last modified

apache airflow UPGRADE

Affected: < 3.3.1

Fixed in: 3.3.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy airflow || rpm -q airflow || airflow --version

2. UPGRADE to 3.3.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade airflow

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade airflow

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Python (pip) · apache-airflow · FIXED · 3.3.1 · vulnerable: < 3.3.1 · source

pip install --upgrade "apache-airflow>=3.3.1" pip show apache-airflow

Fedora 46 · clementine · FIXED · 1.4.2-1.fc46 · FEDORA-2026-3e748ef4d3 · source

sudo dnf upgrade --advisory=FEDORA-2026-3e748ef4d3

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-68076?

airflow: upgrade to 3.3.1. Exact commands for each OS are on this page.

Is CVE-2026-68076 being exploited?

CVE-2026-68076 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-68076 affect?

CVE-2026-68076 affects airflow. Severity is medium (CVSS 5.4). Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a tea

How urgent is CVE-2026-68076?

Priority 31/100. On your watchlist

Related CVEs

CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
CVE-2026-68968 HIGH 7.5 UPGRADE Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf
CVE-2026-65017 MEDIUM 6.5 UPGRADE Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments

References

← Back to latest CVEs