CVE-2026-68871

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-yandex versions prior to 4.5.1

Description The Yandex Lockbox secrets backend in the Yandex provider resolves a team-scoped Connection or Variable id using a team-agnostic lookup if the team-scoped lookup fails. In deployments utilizing multi-team mode, a user in one team can access secrets from another team by providing an id that matches that team's namespace, allowing full retrieval of credentials.

Recommendations Upgrade to apache-airflow-providers-yandex version 4.5.1 or later.