Threats affecting pkg:pypi/apache-airflow-providers-akeyless

CVE-2026-86465 is an authorization bypass vulnerability in the Apache Airflow Akeyless provider affecting multi-team deployments using the Akeyless secrets backend. A Dag author scoped to one team can supply a specially crafted Variable key containing a path separator, causing the backend to resolve secrets belonging to a different team. Single-team deployments are not affected. The issue is fixed in version 0.3.1 of apache-airflow-providers-akeyless.