What’s Vulnerable › Vulnerabilities

CVE-2026-25604: Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-09 · updated 2026-07-02
• Weakness: CWE-346

Description

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.  This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

Affected products

• Apache Software Foundation Apache Airflow Amazon provider: from 8.0.0 before 9.22.0 — fixed in 9.22.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow Amazon provider 9.22.0. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/61368
• https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77
• http://www.openwall.com/lists/oss-security/2026/03/09/6

Get alerted when CVE-2026-25604 or the next vulnerability affects your stack