CVE-2026-86465: Apache Airflow Akeyless Auth Bypass Flaw

CVE-2026-86465 Overview

CVE-2026-86465 is an authorization bypass vulnerability in the Apache Airflow Akeyless provider (apache-airflow-providers-akeyless). The Akeyless secrets backend enforces a team-scope guard that can be bypassed when a Dag author supplies a Variable key containing a path separator. After the team-scoped lookup misses, the backend concatenates the unvalidated key into a new lookup path, resolving a secret owned by a different team. The Execution API Variables route accepts path-shaped keys, so exploitation is reachable from ordinary Dag code in multi-team deployments.

Critical Impact
A Dag author scoped to one team can read secrets belonging to another team, breaking multi-tenant isolation of the Akeyless secrets backend.

Affected Products

apache-airflow-providers-akeyless versions prior to 0.3.1
Apache Airflow multi-team deployments using the Akeyless secrets backend
Not affected: single-team Airflow deployments (no cross-team boundary exists)

Discovery Timeline

2026-09-16 - CVE-2026-86465 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86465

Vulnerability Analysis

The flaw is an Authorization Bypass Through User-Controlled Key ([CWE-639]) in the Akeyless secrets backend integration. In multi-team Airflow deployments, secrets are namespaced by team to enforce tenant isolation. The backend first attempts to resolve a Variable within the caller's team scope. When that lookup misses, the backend falls back to a broader lookup that concatenates the raw, unvalidated key into the resolution path.

A Dag author scoped to team A can supply a Variable key containing a path separator that traverses into team B's namespace. Because the Execution API Variables route accepts path-shaped keys, the attack is reachable from ordinary Dag code without administrative privileges. The class of bug matches CVE-2026-68870, CVE-2026-68871, and CVE-2026-68872 in the Azure Key Vault, Yandex Lockbox, and Amazon secrets backends.

Root Cause

The Akeyless backend does not validate or sanitize the user-supplied Variable key before concatenating it onto the fallback lookup path. The team-scope guard is applied only to the first (scoped) lookup, leaving the fallback lookup effectively unscoped when the key encodes its own path.

Attack Vector

An authenticated Dag author with permission to write Dag code in one team submits a Variable lookup whose key contains a path separator pointing into another team's secret path. Airflow executes the Dag, the scoped lookup misses, and the fallback resolution returns the foreign team's secret value to the Dag context. No user interaction beyond normal Dag execution is required. Refer to the Apache Airflow pull request 72646 for the technical fix details.

Detection Methods for CVE-2026-86465

Indicators of Compromise

Airflow Variable lookups whose keys contain path separators (/, \) or team identifier fragments
Akeyless backend audit logs showing secret access from a Dag whose owning team does not match the resolved secret's team
Execution API requests to the Variables route with unusually structured or nested key strings

Detection Strategies

Correlate Airflow Dag ownership metadata with Akeyless secret access logs to flag cross-team resolutions
Alert on any successful Variable resolution where the resolved secret path prefix differs from the caller's team scope
Review Dag source repositories for Variable.get() calls that build keys dynamically from user input or contain path separators

Monitoring Recommendations

Enable verbose audit logging on the Akeyless secrets backend and forward events to a central analytics platform
Track the version of apache-airflow-providers-akeyless deployed across all Airflow environments
Monitor for anomalous read volume against secrets that were previously accessed by a single team

How to Mitigate CVE-2026-86465

Immediate Actions Required

Upgrade apache-airflow-providers-akeyless to version 0.3.1 or later in every multi-team Airflow deployment
Rotate any Akeyless secrets that could have been resolved by Dags outside their owning team
Audit Airflow Variable access logs since the Akeyless backend was enabled to identify potential cross-team reads

Patch Information

The Apache Airflow project released the fix in apache-airflow-providers-akeyless version 0.3.1. The remediation is tracked in Apache Airflow pull request 72646 and announced on the Apache Airflow mailing list. Related backend bypasses are documented under CVE-2026-68870, CVE-2026-68871, and CVE-2026-68872.

Workarounds

Temporarily switch multi-team deployments to a secrets backend that is not affected until the upgrade is applied
Restrict Dag authorship in shared environments to trusted operators until patching is complete
Add an ingress validation layer that rejects Variable keys containing path separators before they reach the Akeyless backend