CVE-2026-86465 Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...

CVE-2026-86465 Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...

ROOT-APP-MAVEN-CVE-2026-40993 CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41003 CVE-2026-41003 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-41003 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40988 CVE-2026-40988 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-40988 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

EUVD-2026-80069

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2026-86465: Authorization Bypass Through User-Controlled Key

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...

CVE-2026-76187: Improper Authentication

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-92750: Missing Authorization

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

PT-2026-93413

Name of the Vulnerable Software and Affected Versions Apache Airflow Keycloak provider versions 3.3 and later Description The Keycloak auth manager retrieves a user's identity from a signed Airflow session token but obtains Keycloak access and refresh tokens from separate, unauthenticated cookies...

PT-2026-93403

CVE-2026-97636 - Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key CVE ID :CVE-2026-97636 Published : Sept. 24, 2026, 10:17 p.m. | 1 hour, 6 minutes ago Description :Apache Airflow HashiCorp provider: the HashiCorp Vault secrets...

PT-2026-94036

Name of the Vulnerable Software and Affected Versions Harness versions prior to 3.3.0 Description Authenticated users can retrieve provider configurations from spaces to which they do not belong due to missing access control validation in the infrastructure provider read endpoint. By querying the...

CVE-2026-87959: Improper Access Control

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-19607: Improper Authentication

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-81866: Missing Authorization

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret...

PT-2026-93422

Name of the Vulnerable Software and Affected Versions Apache Airflow Apache Kafka provider versions 1.15.0 through 1.9.9 Description The software resolves dotted-path strings found in a Kafka connection's extra field into Python callables using the import string function without an allowlist. The...

CVE-2026-82311: Insufficient Session Expiration

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-86792: Use of Externally-Controlled Input to Select Classes or Code

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

PT-2026-94026

Name of the Vulnerable Software and Affected Versions Marten versions 7.0.0 through 9.12.0 Description Several paths within the LINQ provider and tenant-management internals interpolate runtime strings into single-quoted SQL literals without proper escaping or parameterization. This allows an...