What’s Vulnerable › Vulnerabilities

CVE-2026-46745: Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-25 · updated 2026-07-23
• Weakness: CWE-90

Description

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Affected products

• Apache Software Foundation Apache Airflow FAB provider: before 3.6.4 — fixed in 3.6.4

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow FAB provider 3.6.4. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/66417
• https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh
• http://www.openwall.com/lists/oss-security/2026/05/24/10

Get alerted when CVE-2026-46745 or the next vulnerability affects your stack