42
55
55
55
CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.
CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.
30
30
42
55
55
55
30
60
55
30
60
55
30
55
55
60
55
30
30
55
30
60
42
35
60
42
42
42
55
30
30
42
55
55
55
30