CVE-2026-25604
published 2026-03-09CVE-2026-25604: In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This…
PriorityP433medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.36%
28.2th percentile
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.
This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.
You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apache-airflow-providers-amazon | >= 8.0.0 < 9.22.0 | 9.22.0 |
| apache_software_foundation | apache_airflow_providers_amazon | >= 8.0.0 < 9.22.0 | 9.22.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
ghsa·2026-03-09
CVE-2026-25604 [MEDIUM] CWE-346 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.
This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.
You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
OSV
Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
osv·2026-03-09
CVE-2026-25604 [MEDIUM] Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.
This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.
You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
No detection rules found.
No public exploits indexed.
2026-03-09
Published