Airflow Google provider: team scope dropped in Secret Manager backend, so one team resolves another's credentials

Impact

The Google Cloud Secret Manager secrets backend accepted the caller's team_name but dropped it at the internal call boundary, so every Connection and Variable lookup resolved against the team-agnostic secret name. In multi-team mode a task or Dag belonging to one team therefore resolved another team's Connection and received its credentials in full - not a partial disclosure, the working secret. This is a tenant isolation failure in the exact mechanism that was supposed to enforce it, and it needs no unusual configuration beyond enabling multi-team mode with this backend. Any pipeline that runs on the fleet becomes a way to collect other teams' cloud and cluster credentials.

Who can reach it

Anyone able to author or run a Dag or task under any team on a multi-team Airflow deployment using the Google Cloud Secret Manager secrets backend. Authenticated, but ordinary pipeline-author access is enough.

What to do

Upgrade apache-airflow-providers-google to 22.3.0 or later, which builds and applies the team-scoped secret name, and restart schedulers, triggerers and workers so the new provider is loaded. Treat cross-team credential exposure as having happened: rotate the Connections and Variables that teams could have resolved through the backend. No GPU node drain.

References

Related entries

• Apache Airflow Yandex provider (Lockbox secrets backend, team-scope lookup): When the team-scoped lookup for aCVE-2026-68871 · Apache Airflow Yandex provider (Lockbox secrets backend, team-scope lookup)Medium
• Airflow Amazon provider: AWS secrets backends fall through to a team-agnostic lookup, leaking other teams' credentialsCVE-2026-68872 · Apache Airflow Amazon provider (SSM Parameter Store / Secrets Manager backends)Medium
• Airflow: bulk Variable and Connection endpoints write secrets to the audit log in cleartextCVE-2026-68969 · Apache Airflow (audit-log masking on bulk Variables/Connections endpoints)Medium
• Airflow Task SDK: Variables whose JSON value is a list are not masked in task logs or rendered templatesCVE-2026-68970 · Apache Airflow Task SDK (secret masking for list-valued Variables)Medium
• Airflow: asset materialization authorizes the Dag without its team, letting one team trigger another's runsCVE-2026-68971 · Apache Airflow (asset materialize endpoint and wait_dag_run_until_finished XCom check)Medium
• GitLab CE/EE: authenticated user can stall background job processing via missing object count limitsCVE-2026-77801 · GitLab CE/EE (background job processing)Medium