Vulnerabilities in pkg:pypi/apache-airflow-providers-yandex
PACKAGECVE-2026-68871 is a MODERATE (CVSS 6.5) apache airflow yandex lockbox backend vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting Apache airflow providers yandex libraries in the PyPI ecosystem. The issue involves apache airflow yandex lockbox backend allows cross-team secret disclosure. Remediation is available by upgrading affected packages to version 4.5.1.
pkg:pypi/apache-airflow-providers-yandex
Vulnerability advisories affecting package pkg:pypi/apache-airflow-providers-yandex. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-qmrf-jrpr-rjx6 | CVE-2026-68871 | MODERATE | Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure |
CVE-2026-68871 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-68871
To remediate this vulnerability, upgrade all affected Apache airflow providers yandex dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install apache-airflow-providers-yandex>=4.5.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show apache-airflow-providers-yandexHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-68871, inspect your installed packages using pip:
pip show apache-airflow-providers-yandexAnalyze the terminal output to locate any version of Apache airflow providers yandex in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.5.1), your application is affected.
Note: The pip show apache-airflow-providers-yandex command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, where the system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. In Apache airflow providers yandex, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-68871 Affected Apache airflow providers yandex Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
apache-airflow-providers-yandex
|
PyPI |
< 4.5.1
|
4.5.1
|
References
Frequently Asked Questions
What is CVE-2026-68871?
Which Apache airflow providers yandex versions are affected?
What version fixes CVE-2026-68871?
Is apache-airflow-providers-yandex affected?
What is the CVSS score of CVE-2026-68871?
What CWE is associated with CVE-2026-68871?
How can I check PyPI dependencies for CVE-2026-68871?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-qmrf-jrpr-rjx6",
"modified" : "2026-10-02T23:11:39Z",
"published" : "2026-08-10T21:32:02Z",
"aliases" : [ "CVE-2026-68871" ],
"summary" : "Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure",
"details" : "The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "apache-airflow-providers-yandex"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.5.1"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68871"
}, {
"type" : "WEB",
"url" : "https://github.com/apache/airflow/pull/70877"
}, {
"type" : "WEB",
"url" : "https://github.com/apache/airflow/commit/0d877a1a7680d779d3e8d24cf1bd50b0af1fc8d7"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apache/airflow"
}, {
"type" : "WEB",
"url" : "https://github.com/apache/airflow/releases/tag/providers-yandex/4.5.1"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-yandex/PYSEC-2026-3715.yaml"
}, {
"type" : "WEB",
"url" : "https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c"
}, {
"type" : "WEB",
"url" : "http://www.openwall.com/lists/oss-security/2026/08/10/5"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-639" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-02T23:11:39Z",
"nvd_published_at" : "2026-08-10T19:17:30Z"
}
}