CVE-2026-68871

Received Received - Intake

Yandex Lockbox Credential Exposure in Apache Airflow

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Apache Software Foundation

Description

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-68871

EUVD

EUVD-2026-55698

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache_airflow_providers_yandex	From 4.5.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Apache Airflow's Yandex provider when running in multi-team mode. It allows a user in one team to access secrets belonging to another team by exploiting a fallback mechanism in the Yandex Lockbox secrets backend. The issue occurs when a team-scoped lookup fails, causing the system to use a team-agnostic lookup that could resolve a secret from another team's namespace.

Impact Analysis

If you use Apache Airflow with the Yandex provider in multi-team mode, an attacker within your environment could gain unauthorized access to credentials or sensitive data belonging to other teams. This could lead to data breaches, privilege escalation, or unauthorized actions within your deployment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. It undermines data segregation and access control principles, potentially resulting in legal penalties, loss of trust, and reputational damage.

Mitigation Strategies

Upgrade to apache-airflow-providers-yandex version 4.5.1 or later to prevent team-agnostic secret resolution in multi-team mode.

Hi! I’m here to help you understand CVE-2026-68871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70