Apache Airflow’s Google provider uses Google Cloud Secret Manager to resolve Connections and Variables. In multi‑team mode the provider is supposed to apply a team scope so each team’s secrets are isolated. The vulnerability causes the backend to drop the supplied team_name before performing the lookup, so every team’s requests are resolved against a team‑agnostic secret. As a result, any task or DAG running under one team can read another team’s Connection or Variable, exposing full credentials. The weakness is an information‑exposure flaw (CWE-1220).

The vulnerability affects the Apache Software Foundation’s apache‑airflow‑providers‑google package. All released versions before 22.3.0 are impacted; version 22.3.0 and later correct the team‑scoped secret handling. Any Airflow installation running multi‑team mode with the Google provider prior to the updated version is at risk, regardless of other plugins or configurations.

The flaw is exercised during normal secret lookups with no unusual configuration required beyond multi‑team mode and the Google provider. An attacker who can run a task or load a DAG for a team can obtain another team’s Connection or Variable. No additional privileges are required beyond what the executing DAG already has. The vulnerability is not yet listed in KEV, no public exploits are known, and an EPSS score is not available. The CVSS score of 6.5 indicates a moderate severity, and the potential for credential leakage and ease of exploitation suggest a moderate level of risk.