CVE-2026-86465: CWE-639: Authorization Bypass Through User-Controlled Key in Apache Software Foundation Apache Airflow Akeyless provider
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code. Affects multi-team deployments using the Akeyless secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Azure Key Vault, Yandex Lockbox and Amazon secrets backends. Users of apache-airflow-providers-akeyless are recommended to upgrade to version 0.3.1 or later, which fixes the issue.
AI Analysis
Technical Summary
The Apache Airflow Akeyless provider's team-scope guard can be bypassed by supplying a Variable key with a path separator. In multi-team deployments, this allows a DAG author scoped to one team to access secrets of another team because the backend concatenates the lookup path from an unvalidated key after a team-scoped lookup miss. The Execution API Variables route accepts such path-shaped keys, making this vulnerability exploitable from ordinary DAG code. This vulnerability is similar in nature to CVE-2026-68870, CVE-2026-68871, and CVE-2026-68872 affecting other secrets backends. The issue is resolved in apache-airflow-providers-akeyless version 0.3.1 and later.
Potential Impact
An attacker with DAG author privileges in a multi-team Apache Airflow deployment using the Akeyless secrets backend can bypass team-scoped authorization controls to access secrets belonging to other teams. This could lead to unauthorized disclosure of sensitive secrets across team boundaries. Single-team deployments are not impacted as there is no cross-team boundary.
Mitigation Recommendations
Users should upgrade apache-airflow-providers-akeyless to version 0.3.1 or later, which contains the fix for this vulnerability. Since this is a cloud service component, the vendor manages remediation for the cloud-hosted service. Check the vendor advisory for confirmation and further guidance.
CVE-2026-86465: CWE-639: Authorization Bypass Through User-Controlled Key in Apache Software Foundation Apache Airflow Akeyless provider
Description
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code. Affects multi-team deployments using the Akeyless secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Azure Key Vault, Yandex Lockbox and Amazon secrets backends. Users of apache-airflow-providers-akeyless are recommended to upgrade to version 0.3.1 or later, which fixes the issue.
Affected software
Apache Software Foundation
Apache Airflow Akeyless provider
pkg:pypi/apache-airflow-providers-akeylessRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Apache Airflow Akeyless provider's team-scope guard can be bypassed by supplying a Variable key with a path separator. In multi-team deployments, this allows a DAG author scoped to one team to access secrets of another team because the backend concatenates the lookup path from an unvalidated key after a team-scoped lookup miss. The Execution API Variables route accepts such path-shaped keys, making this vulnerability exploitable from ordinary DAG code. This vulnerability is similar in nature to CVE-2026-68870, CVE-2026-68871, and CVE-2026-68872 affecting other secrets backends. The issue is resolved in apache-airflow-providers-akeyless version 0.3.1 and later.
Potential Impact
An attacker with DAG author privileges in a multi-team Apache Airflow deployment using the Akeyless secrets backend can bypass team-scoped authorization controls to access secrets belonging to other teams. This could lead to unauthorized disclosure of sensitive secrets across team boundaries. Single-team deployments are not impacted as there is no cross-team boundary.
Mitigation Recommendations
Users should upgrade apache-airflow-providers-akeyless to version 0.3.1 or later, which contains the fix for this vulnerability. Since this is a cloud service component, the vendor manages remediation for the cloud-hosted service. Check the vendor advisory for confirmation and further guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-07T14:27:10.417Z
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6aaa5e9855bf5e2cf5487000
Added to database: 09/16/2026, 09:17:12 UTC
Last enriched: 09/16/2026, 09:31:27 UTC
Last updated: 09/17/2026, 01:16:11 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.