Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields of Azure AD id_tokens during OAuth login when configured with Azure AD as the OAuth provider. Because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, tokens minted in any Azure tenant, including attacker-controlled tenants, pass signature verification. This allows attackers to authenticate to the Airflow UI with attacker-controlled tokens, bypassing access controls. The prior fix for CVE-2026-59243 addressed signature verification but did not add issuer or audience validation, leaving the vulnerability open. The issue is fixed starting with apache-airflow-providers-fab version 3.8.1.

Attackers able to create an Azure tenant can authenticate to affected Airflow deployments without prior authorization by presenting a valid id_token from their tenant. This compromises access control to the Airflow UI, potentially allowing unauthorized access to sensitive workflows and data. The vulnerability affects deployments using the FAB auth manager configured with Azure AD OAuth provider. The impact is significant as it allows unauthorized authentication and role assignment bypass.

A patch is available. Operators must upgrade apache-airflow-providers-fab to version 3.8.1 or later to fully remediate this vulnerability. The previous fix (CVE-2026-59243) is insufficient as it did not validate issuer or audience claims. Since this is a cloud service component, the vendor manages remediation for cloud-hosted services; however, for self-hosted deployments, manual upgrade is required. Patch status is confirmed by the vendor advisory.