CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.
CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.
- CVE-2026-86465: team-scope guard bypass in Akeyless secrets backend
- Path separator in user-controlled Variable key resolves cross-team secrets
- Affects apache-airflow-providers-akeyless before 0.3.1
- Relevant to multi-team Airflow deployments
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86465 | Team-scope authorization bypass in Apache Airflow Akeyless secrets backend | 6.5 | — |
From the original article
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow Akeyless provider (apache-airflow-providers-akeyless) before 0. 3. 1 Description: Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.