CVE-2026-68871: Apache Airflow Auth Bypass Vulnerability

CVE-2026-68871 Overview

CVE-2026-68871 is a broken access control flaw [CWE-639] in the Yandex Lockbox secrets backend shipped with Apache Airflow's apache-airflow-providers-yandex package. When a deployment runs in multi-team mode, the backend falls back to a team-agnostic lookup after a team-scoped lookup misses. An authenticated caller in one team can supply an id that names another team's namespace and retrieve that team's Connection or Variable secrets in full.

Critical Impact
Any authenticated user in one team of a multi-team Airflow deployment can read another team's credentials by crafting a secret identifier that names the target team's namespace.

Affected Products

Apache Airflow Yandex provider (apache-airflow-providers-yandex) prior to 4.5.1
Airflow deployments running in multi-team mode
Environments configured with the Yandex Lockbox secrets backend

Discovery Timeline

2026-08-10 - CVE-2026-68871 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68871

Vulnerability Analysis

Apache Airflow supports multi-team mode, where Connections and Variables are namespaced per team. The Yandex Lockbox secrets backend resolves those objects by mapping the caller's team to a Lockbox path prefix. The vulnerability arises in the resolution logic: when a team-scoped lookup returns no result, the backend retries the same id without any team scoping.

The fall-through path treats a caller-supplied identifier as authoritative. A caller in team A can therefore request an id that spells out team B's namespace. Because the team-agnostic query does not enforce ownership, Lockbox returns team B's secret value to team A's caller. The result is a horizontal privilege escalation across tenant boundaries.

Cross-team credential disclosure enables lateral movement into workloads owned by another team, including database connections, cloud service accounts, and API tokens stored as Airflow Variables.

Root Cause

The root cause is an insecure direct object reference in the secrets backend's fallback logic. The team-scoped and team-agnostic namespaces share a key space, and the backend did not refuse identifiers that could name a foreign team's namespace when falling back. The fix in 4.5.1 refuses the team-agnostic fall-through for any id that could resolve to a team namespace.

Attack Vector

Exploitation requires network access to the Airflow environment and low-privilege credentials on any team. The attacker authors or triggers a task that references a Connection or Variable whose id is crafted to match another team's namespace path. The secrets backend returns the foreign team's secret material to the executing task context, where the attacker can exfiltrate it through logs, XCom, or outbound network calls.

No unusual configuration is required. The flaw is triggered whenever multi-team mode and the Yandex Lockbox backend are both enabled.

Detection Methods for CVE-2026-68871

Indicators of Compromise

Airflow task logs containing secret material or Connection URIs that belong to a team other than the DAG owner's team
Lockbox API access logs showing reads of secret paths outside the requesting team's namespace prefix
DAGs or tasks that reference Connection or Variable id values matching another team's namespace pattern
Anomalous use of another team's credentials against Yandex Cloud services shortly after task execution

Detection Strategies

Audit all DAG definitions and task parameters for Connection or Variable identifiers that embed a team namespace prefix the DAG author does not own
Correlate Lockbox GetPayload API calls with the requesting Airflow team identity and alert on mismatches
Enable Airflow audit logging and search for secret resolution events where the resolved namespace differs from the caller's team

Monitoring Recommendations

Forward Yandex Cloud Audit Trails and Airflow scheduler and worker logs to a centralized analytics platform for cross-source correlation
Baseline each team's normal set of Connection and Variable identifiers and alert on first-time references to unfamiliar identifiers
Monitor for unexpected downstream authentications using credentials whose issuing team differs from the calling workload

How to Mitigate CVE-2026-68871

Immediate Actions Required

Upgrade apache-airflow-providers-yandex to 4.5.1 or later on every scheduler, worker, and triggerer node
Rotate all Connections and Variables managed through the Yandex Lockbox backend, since prior disclosure cannot be ruled out
Review DAG code and task parameters for identifiers crafted to reference foreign team namespaces
Restrict who can author or modify DAGs in multi-team environments until the upgrade is complete

Patch Information

The fix is delivered in apache-airflow-providers-yandex version 4.5.1. The patched backend refuses the team-agnostic fall-through when the requested id could name a team namespace, closing the cross-team resolution path. See the Apache Airflow pull request and the Apache mailing list disclosure for details.

Workarounds

Disable multi-team mode until the provider can be upgraded, collapsing all workloads into a single trust boundary
Replace the Yandex Lockbox secrets backend with an alternative backend that enforces per-team isolation
Segment Airflow deployments so that each team runs in a dedicated environment with its own Lockbox scope

bash

# Upgrade the affected provider on all Airflow nodes
pip install --upgrade "apache-airflow-providers-yandex>=4.5.1"

# Verify installed version
pip show apache-airflow-providers-yandex | grep -i version