Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86465

Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86465

Published

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code. Affects multi-team deployments using the Akeyless secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Azure Key Vault, Yandex Lockbox and Amazon secrets backends. Users of apache-airflow-providers-akeyless are recommended to upgrade to version 0.3.1 or later, which fixes the issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86465

Published

apache-airflow-providers-akeyless

https://pypi.python.org

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:pypi/apache-airflow-providers-akeyless",
                    "product": "Apache Airflow Akeyless provider",
                    "vendor": "Apache Software Foundation",
                    "versions": [
                        {
                            "lessThan": "0.3.1",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ],
                    "collectionURL": "https://pypi.python.org",
                    "packageName": "apache-airflow-providers-akeyless"
                }

Original source record · Cite this exact observation · Complete original publisher JSON