CVE-2026-97636

The apache-airflow-providers-hashicorp component is vulnerable to a team-scope guard bypass in the HashiCorp Vault secrets backend. In multi-team deployments, a Dag author can provide a user-controlled Variable key containing path separators. If the team-scoped lookup fails, the backend falls bac...