CVE-2026-68871

This CVE exposes a fundamental flaw in how the Yandex Lockbox secret backend resolved secrets across team boundaries in multi-tenant Airflow deployments. The vulnerability wasn't a missing access check—it was a fallback resolution path that allowed any authenticated caller to retrieve secrets from teams other than their own by supplying a connection ID that happened to match another team's namespace pattern. The 4.5.1 patch adds a heuristic gate: refuse fallthrough when the supplied ID could plausibly name a team namespace. This is the right immediate fix, but it treats a symptom rather than eradicating the underlying pattern. The fallback was a deliberate backward-compatibility bridge to ease migration from single-tenant to multi-tenant Airflow—operators with existing Connection IDs in their configs could deploy into multi-team mode without rewiring everything. That convenience created the attack surface. The heuristic check now encodes a snapshot of what team namespace patterns look like today; future namespace format changes, renaming conventions, or edge-case formatting could resurrect the ambiguity the patch attempts to close. The CVSS of 6.5 understates the real risk: once credentials exfiltrate across the team boundary, the attacker pivots into every system those credentials touch—cloud infrastructure, external APIs, data pipelines—escaping the Airflow access model entirely. Check your deployment's Yandex Lockbox backend version (upgrade to 4.5.1 or later), audit whether team namespaces follow predictable naming patterns that could be enumerated, and investigate whether other secret backends in your provider ecosystem implement similar fallback resolution that could carry the same defect. The fix shifts the burden to operators who must now understand namespace formatting rules—ensure your team documents this contract explicitly and monitors for any resolution paths that fall through the heuristic gate.

Reviewed through automated stages and approved by a human before publication.