Executive brief
Apache Airflow's Akeyless secrets backend in multi-team deployments can be bypassed to expose secrets belonging to different teams. A DAG author with access to only their own team can craft a specially formatted secret key that causes the system to retrieve sensitive data from another team's vault. This allows unauthorized cross-team access to database credentials, API keys, and other secrets stored in the Akeyless backend.
Technical details
The vulnerability is a path traversal/namespace escape in the Akeyless secrets backend's team-scope validation. When a secret lookup fails within the team-scoped path, the backend concatenates an unvalidated user-supplied key to construct a fallback lookup path, bypassing team isolation. An attacker can inject path separators into a Variable key to escape the team namespace and access secrets from other teams. The Execution API Variables route accepts arbitrary path-shaped keys, making this exploitable from DAG code without special privileges. The fix in version 0.3.1 validates that secret IDs do not reference other teams' namespaces.
Affected products
- Apache Airflow Akeyless provider before 0.3.1
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Fix merged in PR #72646