The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider allows a user in a multi‑team deployment to resolve a secret that belongs to another team. When the lookup for a team‑scoped Connection or Variable fails, the backend falls back to a team‑agnostic lookup that can interpret an identifier as a team namespace. This bypass of the team‑scope guard enables access to another team’s credentials through a simple lookup of the target team’s namespace.

Apache Airflow in the Yandex provider component, specifically when the Yandex Lockbox backend is enabled and multi‑team mode is active. The CVE report does not specify affected product versions, so any installation using the Yandex provider with multi‑team mode may be vulnerable.

The vulnerability is an Authorization Bypass Through User‑Controlled Key (CWE‑639). It does not require uncommon configuration – merely enabling multi‑team mode and using the Yandex Lockbox backend. No CVSS score is listed and the EPSS value is unavailable, but the flaw relies on legitimate platform capabilities and can be exploited by any user who can specify a secret identifier. The KEV status is not listed, indicating no public reports of exploitation yet. However, because secrets are disclosed, the potential impact is high for confidentiality and may allow lateral movement in a multi‑team Airflow environment.