CVE-2026-75156: CWE-346: Origin Validation Error in Apache Software Foundation Apache Airflow FAB provider

The Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth login. Although the signature verification was addressed in a previous fix (CVE-2026-59243), the lack of issuer and audience validation allows any id_token from any Azure tenant to be accepted. Because the signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, an attacker who registers an Azure tenant can craft a valid token that passes signature verification and grants unauthorized access to the Airflow UI with attacker-controlled username and role assignments. This vulnerability affects deployments configured to use Azure AD as an OAuth provider with the FAB auth manager. The issue is resolved in apache-airflow-providers-fab version 3.8.1 and later.

An attacker able to create an Azure tenant can authenticate to the Airflow UI without prior authorization by presenting a valid id_token from their own tenant. This leads to unauthorized access with attacker-controlled usernames and roles, resulting in a complete compromise of confidentiality and integrity of the Airflow deployment's user authentication. Availability is not impacted. The vulnerability has a CVSS score of 9.1 (critical).

A patch is available. Operators must upgrade apache-airflow-providers-fab to version 3.8.1 or later to fully remediate this vulnerability. Deployments that applied the previous fix for CVE-2026-59243 remain vulnerable and must upgrade again. Since this is a cloud-hosted service component, the vendor manages remediation for cloud services; users should verify their deployment version and upgrade accordingly.