Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-86465

Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code. Affects multi-team deployments using the Akeyless secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Azure Key Vault, Yandex Lockbox and Amazon secrets backends. Users of apache-airflow-providers-akeyless are recommended to upgrade to version 0.3.1 or later, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Airflow Akeyless provider

Default version status: unaffected

  • 0 to < 0.3.1affected
pkg:pypi/apache-airflow-providers-akeyless

References