CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.
CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.
- CVE-2026-86465: team-scope guard bypass in Akeyless secrets backend
- Path separator in user-controlled Variable key resolves cross-team secrets
- Affects apache-airflow-providers-akeyless before 0.3.1
- Relevant to multi-team Airflow deployments
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-86465 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow Akeyless provider (apache-airflow-providers-akeyless) before 0.3.1 Description: Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a...
This source does not provide full text. Read it at seclists.org.