Threat Intelligence Database

CVE-2026-86466 is a high-severity vulnerability in the Apache Airflow FAB provider affecting versions prior to 3.9.0. The issue arises because the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. This allows an attacker with a valid token for another application from the same Authentik identity provider to authenticate as any user in Airflow without proper authorization. The vulnerability is fixed in version 3.9.0.

CVE-2026-82310 is a vulnerability in the Apache Airflow FAB provider where deactivating a user account does not invalidate previously issued tokens. Although password authentication blocks disabled accounts, the Core API continues to accept existing unexpired tokens and allows them to mint replacements, enabling continued access with the original roles. This affects deployments using Airflow 3 with FAB auth manager and Core API token authentication. Upgrading to version 3.9.0 or later mitigates the issue by rejecting tokens for deactivated accounts.

Apache Airflow FAB provider versions 3.2.0 through 3.8.x have a vulnerability where changing a user's password via the Admin user-edit PATCH endpoint does not invalidate existing database-backed sessions. This allows an attacker with a stolen session cookie to maintain access even after the password is changed. The issue affects deployments using the FAB auth manager with database-backed sessions and requires no attacker interaction with the password change endpoint. The vulnerability is fixed in version 3.9.0 and later.

CVE-2026-82311 is a critical vulnerability in the Apache Airflow FAB provider affecting deployments using the FAB auth manager with database-backed session storage. When a user's password is reset, existing sessions are not properly deleted due to a mismatch in identifier comparison, allowing an attacker with a stolen session cookie to maintain access even after the password change. This issue is fixed in version 3.9.0, which corrects the identifier comparison logic. The vulnerability has a CVSS score of 9.8, indicating high severity.

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.

Apache Airflow FAB Auth Manager has an LDAP injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. This affects versions prior to 3.6.4 of the apache-airflow-providers-fab package. The vulnerability has a medium severity with a CVSS score of 5.3. Users are advised to upgrade to version 3.6.4 or later. If upgrading immediately is not possible, disabling LDAP authentication is recommended until the provider is updated.