CVE-2026-86465

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because the lookup path is concatenated from an unvalidated key after the team-scoped lookup misses. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code. Affects multi-team deployments using the Akeyless secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Azure Key Vault, Yandex Lockbox and Amazon secrets backends. Users of apache-airflow-providers-akeyless are recommended to upgrade to version 0.3.1 or later, which fixes the issue.

• CWE-639

• https://github.com/apache/airflow/pull/72646Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0gMailing List, Vendor Advisory
• https://lists.apache.org/thread/vczt5xgqjv8ot8fpp1vdq3rmnfm50w0g?users@airflow.apache.orgMailing List, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-68870Not Applicable
• https://www.cve.org/CVERecord?id=CVE-2026-68871Not Applicable
• https://www.cve.org/CVERecord?id=CVE-2026-68872Not Applicable

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86451Affected versions of MISP allow authenticated users to retri…4.3
• CVE-2026-86452Affected versions of MISP permit unauthenticated or weakly c…7.5
• CVE-2026-8646IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphe…9.1
• CVE-2026-86460Cypher injection vulnerability in the Neo4j persistence laye…9.8
• CVE-2026-86462Apache Airflow FAB provider: changing a user's password thro…9.1
• CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
• CVE-2026-86466Apache Airflow FAB provider: the Authentik OAuth path in the…8.1
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8
• CVE-2026-86472fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8
• CVE-2026-86473Apache Airflow: the Core API logout endpoint revokes only a …9.1
• CVE-2026-86474The lack of TLS certificate validation when downloading firm…7.7