AIKIDO-2026-440780

TL;DR

The Yandex Cloud Lockbox secrets backend resolves a team-scoped Connection or Variable ID through a team-agnostic fallback lookup whenever the team-scoped lookup misses. The guard meant to block that path only checks whether team context is absent, so it never runs when a caller from one team supplies an ID that names another team's namespace and retrieves that team's secret credentials in full. The fix refuses any Connection, Variable, or Config lookup whose ID names a team namespace before either lookup runs.