Airflow HashiCorp provider: path-shaped Variable key crosses team scope in the Vault secrets backend

Impact

In a multi-team Airflow deployment, the Vault secrets backend falls back to a team-agnostic path built from an unvalidated key after the team-scoped lookup misses. A Dag author scoped to one team can therefore supply a Variable key containing a path separator and read a secret belonging to another team, and the Execution API Variables route accepts path-shaped keys, so ordinary Dag code reaches it. On a shared GPU cluster where Airflow orchestrates training and data pipelines, the secrets in question are typically registry credentials, cloud keys and storage tokens, so one tenant's pipeline author can obtain another tenant's credentials. Single-team deployments have no boundary to cross and are unaffected. Apache notes this is the same class as CVE-2026-86465, CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Akeyless, Azure Key Vault, Yandex Lockbox and Amazon backends; those ids are not in this batch and are not consolidated here.

Who can reach it

An authenticated Airflow user who can author or edit a Dag in one team, in a multi-team deployment using the HashiCorp Vault secrets backend. No cluster or Vault credentials needed beyond that.

What to do

Upgrade apache-airflow-providers-hashicorp to 4.8.0 or later and restart the scheduler, workers and API server so the new provider loads; no node drain or reboot. Rotate any Vault secrets a cross-team Dag author could have read, since reads leave little trace. Single-team deployments can patch on the normal cycle.

References

Related entries

• Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL andNCVD-2024-010-ceph-python-bindings-imap4-ssl-s · Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients)Medium
• rclone (serve s3): Path traversal in rclone's S3 gateway lets a caller read and overwrite files above the served root.NCVD-2026-042-rclone-serve-s3 · rclone (serve s3)Medium
• KubeEdge CloudHub (viaduct packer, pkg/viaduct/pkg/packer): ONE COMPROMISED EDGE NODE TAKES DOWN CLOUD-EDGENCVD-2026-053-kubeedge-cloudhub-viaduct-packer · KubeEdge CloudHub (viaduct packer, pkg/viaduct/pkg/packer)Medium
• GitLab CE/EE: pipeline creation race lets a developer act in the context of another user's merge request commitCVE-2024-11222 · GitLab CE/EE (pipeline creation race condition)Medium
• GitLab CE/EE: authenticated user can obtain higher-privileged users' credentials and act as themCVE-2024-9183 · GitLab CE/EE (credential exposure to lower-privileged users)Medium
• Ansible Automation Platform images: group-writable /etc/passwd lets a container user become root in-containerCVE-2025-57847 · Red Hat Ansible Automation Platform container images (/etc/passwd permissions)Medium