Apache Airflow’s environment-variable secrets backend can resolve a team-scoped Connection or Variable from the wrong team's scope. A guard intended to block this only ran when no team scope was supplied, and could not match team names that include underscores, a valid naming convention. When the guard did not apply, the lookup fell through to an unconditional global read, resolving the stored AIRFLOW_CONN__<TEAM>___<ID> variable regardless of which team requested it. In multi-team mode, an authenticated user of one team could therefore use the POST /api/v2/connections/test endpoint to resolve another team’s Connection and authenticate outward with that team’s credentials; the endpoint uses the credentials rather than merely returning them.

Apache Software Foundation’s Apache Airflow, versions prior to 3.3.1, in multi-team deployments that enable the environment‑variable secrets backend and the test_connection feature.

The CVSS score of 5.4 indicates moderate severity. Exploitation requires that multi_team is enabled, test_connection is set to Enabled (the default is Disabled), team‑scoped secrets are provisioned as environment variables in the API‑server process, and the attacker knows the encoded identifier. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting a moderate likelihood of exploitation but possibly limited due to the prerequisite conditions.