Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-akeyless is a Provider package apache-airflow-providers-akeyless for Apache Airflow Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Akeyless secrets backend. An attacker can access secrets belonging to...

CVE-2026-86465

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...