Detections
Analytics

Echo: apache-airflow: security update to 3.3.1

medium Tenable Self-Hosted Container Security Plugin ID 472771

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from
 the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its
 pattern could not match a team name containing an underscore, which team names are allowed to contain.
 When the guard did not apply, the lookup fell through to an unconditional global read that resolved the
 stored `AIRFLOW_CONN__<TEAM>___<ID>` variable regardless of which team asked. In multi-team mode an
 authenticated user of one team could therefore have `POST /api/v2/connections/test` resolve another team's
 Connection and authenticate outward with that team's credentials; the endpoint uses the credentials rather
 than returning them. Exploitation requires `[core] multi_team` enabled, `[core] test_connection` set to
 `Enabled` (it ships `Disabled`), team-scoped secrets provisioned as environment variables in the API-
 server process, and knowledge of the encoded identifier. Redirecting the test at an attacker-controlled
 host is separately blocked. Users are advised to upgrade to apache-airflow 3.3.1 or later.
 (CVE-2026-68076)

Solution

Update the apache-airflow library and its related packages to version 3.3.1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-68076

Plugin Details

Severity: Medium

ID: 472771

Version: Revision 1.1

Type: Local

Published: 10/5/2026

Updated: 10/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.92

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:P

CVSS Score Source: CVE-2026-68076

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/4/2026

Vulnerability Publication Date: 8/12/2026

Reference Information

CVE: CVE-2026-68076