Apache Airflow Hashicorp Provider
Monthly
Cross-team secret disclosure in the HashiCorp Vault secrets backend for Apache Airflow lets an authenticated Dag author scoped to one team read Vault secrets belonging to a different team in multi-team deployments. The flaw (CWE-639, authorization bypass through a user-controlled key) triggers when the team-scoped lookup misses and the backend falls back to a team-agnostic path concatenated from the unvalidated Variable key; because the Execution API Variables route accepts a path-shaped key, the traversal is reachable from ordinary Dag code. The vendor assigned no CVSS score (CVSS: N/A), while the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - read-only disclosure with scope change and no integrity or availability impact; single-team deployments are unaffected, no public exploit code has been identified at time of analysis, and the vendor-released fix is apache-airflow-providers-hashicorp 4.8.0.
Cross-team secret disclosure in the HashiCorp Vault secrets backend for Apache Airflow lets an authenticated Dag author scoped to one team read Vault secrets belonging to a different team in multi-team deployments. The flaw (CWE-639, authorization bypass through a user-controlled key) triggers when the team-scoped lookup misses and the backend falls back to a team-agnostic path concatenated from the unvalidated Variable key; because the Execution API Variables route accepts a path-shaped key, the traversal is reachable from ordinary Dag code. The vendor assigned no CVSS score (CVSS: N/A), while the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - read-only disclosure with scope change and no integrity or availability impact; single-team deployments are unaffected, no public exploit code has been identified at time of analysis, and the vendor-released fix is apache-airflow-providers-hashicorp 4.8.0.