Apache Software Foundation Apache Airflow FAB provider vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest Apache Software Foundation Apache Airflow FAB provider vulnerabilities

CVE-2026-86466 — Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated (CVSS 8.1)
CVE-2026-82310 — Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access (CVSS 7.2)
CVE-2026-86462 — Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions (CVSS 9.1)
CVE-2026-82311 — Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false (CVSS 9.8)
CVE-2026-75156 — Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass (CVSS 9.1)
CVE-2026-59243 — Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) (CVSS 9.8)
CVE-2026-59245 — Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) (CVSS 8.1)
CVE-2026-46745 — Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token (CVSS 5.3)
CVE-2024-45033 — Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli (CVSS 8.1)
CVE-2024-42447 — Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow (CVSS 9.8)