All vulnerabilities
CVE-2026-68871GHSA-qmrf-jrpr-rjx6PYSEC-2026-3715

apache-airflow-providers-yandex: Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure

Apache Software Foundation apache-airflow-providers-yandexpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.1Fixed versionGitHub
Published10 Aug 2026Updated 2 Oct 2026CVE List

What fixes it

  • 4.5.1apache-airflow-providers-yandex, pipGitHub
  • 4.5.1Apache Airflow Yandex providerCVE List
  • 4.5.1apache-airflow-providers-yandex, PyPIOSVpip install "apache-airflow-providers-yandex>=4.5.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

Text from CVE List

Affected versions 53

  • apache-airflow-providers-yandex, pip< 4.5.1GitHub
  • Apache Airflow Yandex provideraffected: all versions before 4.5.1CVE List
  • apache-airflow-providers-yandex, PyPIfrom first release, fixed in 4.5.1OSV
  • apache-airflow-providers-yandex, PyPI1.0.0OSV
  • apache-airflow-providers-yandex, PyPI1.0.0b1OSV
  • apache-airflow-providers-yandex, PyPI1.0.0b2OSV
  • apache-airflow-providers-yandex, PyPI1.0.0rc1OSV
  • apache-airflow-providers-yandex, PyPI1.0.1OSV
  • apache-airflow-providers-yandex, PyPI1.0.1rc1OSV
  • apache-airflow-providers-yandex, PyPI2.0.0OSV
  • apache-airflow-providers-yandex, PyPI2.0.0rc1OSV
  • apache-airflow-providers-yandex, PyPI2.0.0rc2OSV
  • apache-airflow-providers-yandex, PyPI2.1.0OSV
  • apache-airflow-providers-yandex, PyPI2.1.0rc1OSV
  • apache-airflow-providers-yandex, PyPI2.2.0OSV
  • apache-airflow-providers-yandex, PyPI2.2.0rc1OSV
  • apache-airflow-providers-yandex, PyPI2.2.1OSV
  • apache-airflow-providers-yandex, PyPI2.2.1rc1OSV
  • apache-airflow-providers-yandex, PyPI2.2.2OSV
  • apache-airflow-providers-yandex, PyPI2.2.2rc1OSV
  • apache-airflow-providers-yandex, PyPI2.2.3OSV
  • apache-airflow-providers-yandex, PyPI2.2.3rc1OSV
  • apache-airflow-providers-yandex, PyPI3.0.0OSV
  • apache-airflow-providers-yandex, PyPI3.0.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.0.0rc2OSV
  • apache-airflow-providers-yandex, PyPI3.1.0OSV
  • apache-airflow-providers-yandex, PyPI3.1.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.1.0rc2OSV
  • apache-airflow-providers-yandex, PyPI3.1.0rc3OSV
  • apache-airflow-providers-yandex, PyPI3.10.0OSV
  • apache-airflow-providers-yandex, PyPI3.10.0rc2OSV
  • apache-airflow-providers-yandex, PyPI3.11.0OSV
  • apache-airflow-providers-yandex, PyPI3.11.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.11.1OSV
  • apache-airflow-providers-yandex, PyPI3.11.1rc1OSV
  • apache-airflow-providers-yandex, PyPI3.11.2OSV
  • apache-airflow-providers-yandex, PyPI3.11.2rc1OSV
  • apache-airflow-providers-yandex, PyPI3.12.0OSV
  • apache-airflow-providers-yandex, PyPI3.12.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.2.0OSV
  • apache-airflow-providers-yandex, PyPI3.2.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.2.0rc2OSV
  • apache-airflow-providers-yandex, PyPI3.2.0rc3OSV
  • apache-airflow-providers-yandex, PyPI3.3.0OSV
  • apache-airflow-providers-yandex, PyPI3.3.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.4.0OSV
  • apache-airflow-providers-yandex, PyPI3.4.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.5.0OSV
  • apache-airflow-providers-yandex, PyPI3.5.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.6.0OSV
  • apache-airflow-providers-yandex, PyPI3.6.0rc1OSV
  • apache-airflow-providers-yandex, PyPI3.7.0OSV
  • apache-airflow-providers-yandex, PyPI3.7.0rc1OSV

References 7