CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow HashiCorp provider flaw lets a team-scoped DAG author read another team's Vault secret.
Apache disclosed CVE-2026-97636, rated moderate, in the Apache Airflow HashiCorp provider. Versions 4.6.0 before 4.8.0 let a DAG author scoped to one team supply a Variable key containing a path separator so the Vault secrets backend resolves a secret owned by another team. The issue affects multi-team deployments that use the Vault secrets backend. Apache fixed the guard bypass in provider 4.8.0.
- CVE-2026-97636 is rated moderate by Apache.
- HashiCorp provider 4.6.0 before 4.8.0 is affected.
- A Variable key with a path separator bypasses the team-scope guard.
- Multi-team Airflow deployments should upgrade to provider 4.8.0.
- CVEs
- CVE-2026-97636
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97636 | Apache Airflow HashiCorp provider | 6.5 | — |
From the original article
Posted by Jarek Potiuk on Sep 24 Severity: moderate Affected versions: - Apache Airflow HashiCorp provider 4. 6. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.