CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

As cited

Copy frozen at 2026-09-15 22:32 UTC (site build).

vulnerabilities

CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider before version 0.3.1 contains a moderate severity vulnerability in its secrets backend that allows a directed acyclic graph (DAG) author to bypass team-scope restrictions by supplying a user-controlled key with a path separator. In multi-team deployments, this enables an author scoped to one team to access secrets belonging to another team.

Why it matters: Airflow administrators managing multi-tenant environments should update the Akeyless provider immediately, as DAG authors can escalate access to cross-team secrets without additional privileges.

Source published

2026-09-15 20:03 UTC

First seen by Cybersecurity Tracker

2026-09-15 21:27 UTC