Apache Apache-Airflow-Providers-Fab vulnerabilities

CVE-2026-59243 [CRITICAL] CWE-347 CVE-2026-59243: The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manag

CVE-2026-82311 [CRITICAL] CWE-613 CVE-2026-82311: Apache Airflow FAB provider: resetting a user's password does not delete that user's existing databa Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An

CVE-2026-86462 [CRITICAL] CVE-2026-86462: Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint d Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments us

CVE-2026-75156 [CRITICAL] CWE-346 CVE-2026-75156: Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of A Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` min

CVE-2024-42447 [CRITICAL] CWE-613 CVE-2024-42447: Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects A Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Ai

CVE-2026-59245 [HIGH] CWE-269 CVE-2026-59245: In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all- In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists an

CVE-2026-86466 [HIGH] CVE-2026-86466: Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim

CVE-2026-82310 [HIGH] CWE-613 CVE-2026-82310: Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement — so the account keeps its role-scoped access indef

CVE-2024-45033 [HIGH] CVE-2024-45033: Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Ap Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password w

CVE-2026-46745 [MEDIUM] CWE-90 CVE-2026-46745: Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.