Skip to main content

Apache CVE-2026-86466

CRITICAL
2026-09-15
Apache Information Disclosure Microsoft
Share

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 22:15 vuln.today
CVE Published
Sep 15, 2026 - 20:01 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

The Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0 fails to validate the issuer and audience claims of id_tokens presented to its Authentik OAuth login path, so any token that the same Authentik deployment minted for a different client application is accepted by Airflow and authenticates the attacker as the user named in that token. Only deployments running the FAB auth manager with Authentik OAuth against an Authentik instance that also serves other applications are affected — the attacker needs a valid token for one of those other apps, not for Airflow itself. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-86466 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy