The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deploy
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | apache-airflow-providers-yandex | < 4.5.1 | 4.5.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-68871
- https://github.com/apache/airflow/pull/70877
- https://github.com/apache/airflow/commit/0d877a1a7680d779d3e8d24cf1bd50b0af1fc8d7
- https://github.com/apache/airflow
- https://github.com/apache/airflow/releases/tag/providers-yandex/4.5.1
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-yandex/PYSEC-2026-3715.yaml
- https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c
- http://www.openwall.com/lists/oss-security/2026/08/10/5
- https://github.com/advisories/GHSA-qmrf-jrpr-rjx6
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-639- Platform
- Python (PyPI)
- Package
apache-airflow-providers-yandex- Disclosed
- 10.08.2026
- Updated
- 15.10.2026 18:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3715 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-qmrf-jrpr-rjx6 - CC BY 4.0
Vulnerability history: apache-airflow-providers-yandex
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.