CVE-2026-86467: CWE-352: Cross-Site Request Forgery (CSRF) in Apache Software Foundation Apache Airflow Amazon provider

The Apache Airflow Amazon provider's AWS auth manager has a CSRF vulnerability in its SAML login flow. Specifically, the login handler discards the AuthnRequest ID and the callback validates the SAML assertion without requiring a matching InResponseTo attribute. This allows an unauthenticated attacker to induce a victim's browser to complete a SAML login using the attacker's assertion, silently logging the victim into the attacker's Airflow account. As a result, any subsequent actions by the victim occur within a session controlled by the attacker. This vulnerability affects versions prior to 9.38.0 and is similar to a previously fixed login-CSRF issue in the Keycloak auth manager (CVE-2026-40948).

An attacker can trick a victim into logging into the attacker's Airflow account without the victim's knowledge by causing the victim to visit a malicious page. This leads to the victim performing actions in a session controlled by the attacker, potentially causing confusion, unauthorized actions, or data integrity issues within the victim's Airflow environment. The attacker does not need any credentials or prior access to the victim's Airflow account.

Users should upgrade the apache-airflow-providers-amazon package to version 9.38.0 or later, where this CSRF vulnerability in the AWS auth manager's SAML login flow is fixed. Since this is a cloud-hosted service component, the vendor manages remediation for the service itself, but users running affected versions must apply the update to mitigate the issue.