CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

EUVD-2026-86475

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636

The apache-airflow-providers-hashicorp component is vulnerable to a team-scope guard bypass in the HashiCorp Vault secrets backend . In multi-team deployments, a Dag author can provide a Variable key containing a path separator . This causes the backend to fall back to a team-agnostic path, allow...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-97636 Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-94416

An authorization bypass exists in the Ansible Automation Platform (AAP) gateway due to a lack of restrictions on service key creation . An authenticated administrator can create a new service key for the Controller service cluster that is cryptographically indistinguishable from legitimate keys. ...

CVE-2026-94416 Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-97636: Authorization Bypass Through User-Controlled Key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-94416: Authentication Bypass by Spoofing

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

PT-2026-98313

CVE-2026-97636 Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Da… https://t.co/UZkMPyWzeJ...

Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

Incorrect Authorization

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more...