The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider allows a user in a multi‑team deployment to resolve a secret that belongs to another team. When the lookup for a team‑scoped Connection or Variable fails, the backend falls back to a team‑agnostic lookup that can interpret an identifier as a team namespace. This bypass of the team‑scope guard enables access to another team’s credentials through a simple lookup of the target team’s namespace.

Apache Airflow in the Yandex provider component, specifically when the Yandex Lockbox backend is enabled and multi‑team mode is active. The CVE report does not specify affected product versions, so any installation using the Yandex provider with multi‑team mode may be vulnerable.

The vulnerability is an Authorization Bypass Through User‑Controlled Key (CWE‑639). It does not require uncommon configuration – merely enabling multi‑team mode and using the Yandex Lockbox backend. The CVSS score is 6.5 and the EPSS score is < 1%, indicating a moderate severity with a low exploitation probability. The KEV status is not listed, indicating no public reports of exploitation yet. Because secrets are disclosed, the potential impact is high for confidentiality and may allow lateral movement in a multi‑team Airflow environment.