EUVD-2026-55698
GHSA-qmrf-jrpr-rjx6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-delivered via Airflow API, low-privilege team membership required, scope changes across team boundary, high confidentiality loss; no integrity or availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
AnalysisAI
Cross-team secret disclosure in Apache Airflow's Yandex Lockbox secrets backend exposes one team's credentials to members of a different team in multi-team deployments. Any authenticated Airflow user belonging to any team can retrieve connections or variables owned by another team by supplying a secret ID that embeds the target team's namespace separator sequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific, non-default deployment choices: (1) Apache Airflow must be running in multi-team mode, and (2) the Yandex Lockbox secrets backend must be configured as the secrets provider. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or vector was provided by NVD at time of analysis, requiring independent assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade apache-airflow-providers-yandex to version 4.5.1 or later, which is confirmed as the vendor-released fix per the Apache advisory (https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c) and PR #70877. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today