Apache Software Foundation Apache Airflow Fab Provider vulnerabilities

CVE-2026-59243 [CRITICAL] CWE-347 CVE-2026-59243: The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manag

CVE-2026-82311 [CRITICAL] CWE-613 CVE-2026-82311: Apache Airflow FAB provider: resetting a user's password does not delete that user's existing databa Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An

CVE-2026-75156 [CRITICAL] CWE-346 CVE-2026-75156: Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of A Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` min

CVE-2026-59245 [HIGH] CWE-269 CVE-2026-59245: In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all- In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists an

CVE-2026-82310 [HIGH] CWE-613 CVE-2026-82310: Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement — so the account keeps its role-scoped access indef

CVE-2023-40273 [HIGH] CWE-384 CVE-2023-40273: The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webs The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webse

CVE-2026-46745 [MEDIUM] CWE-90 CVE-2026-46745: Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.