Apache Airflow Yandex Provider
Monthly
Cross-team secret disclosure in Apache Airflow's Yandex Lockbox secrets backend exposes one team's credentials to members of a different team in multi-team deployments. Any authenticated Airflow user belonging to any team can retrieve connections or variables owned by another team by supplying a secret ID that embeds the target team's namespace separator sequence. The flaw requires only that multi-team mode and the Yandex Lockbox backend are active - both standard, documented configurations - and yields full plaintext credential exposure. No public exploit or CISA KEV listing exists at time of analysis.
Cross-team secret disclosure in Apache Airflow's Yandex Lockbox secrets backend exposes one team's credentials to members of a different team in multi-team deployments. Any authenticated Airflow user belonging to any team can retrieve connections or variables owned by another team by supplying a secret ID that embeds the target team's namespace separator sequence. The flaw requires only that multi-team mode and the Yandex Lockbox backend are active - both standard, documented configurations - and yields full plaintext credential exposure. No public exploit or CISA KEV listing exists at time of analysis.