Airflow Amazon Provider CVE-2026-86467

Exploitation requires the deployment to use the AWS auth manager of apache-airflow-providers-amazon configured specifically with SAML authentication - Airflow installations using any other auth manager or non-SAML auth are not affected. The vulnerable condition is that the SAML login handler discards the AuthnRequest ID and the callback validates the assertion without enforcing a matching InResponseTo, so the response is not bound to the browser that began the flow. LIMITING FACTORS: the victim must take an action (visit/load an attacker-controlled page) for the login CSRF to fire, so it is not fully silent server-side exploitation; and affected versions are strictly apache-airflow-providers-amazon before 9.38.0. The attacker needs no Airflow account, credential, or prior access per the vendor description, but CVSS-based authentication status cannot be confirmed because no CVSS vector was supplied in the input.

No CVSS vector, EPSS score, KEV entry, or POC indicator was supplied in the input, so quantitative exploitation signals are entirely absent and this assessment rests on the vendor advisory text alone. The vendor rates this 'moderate,' consistent with a login-CSRF class flaw: the attacker gains nothing by compromising the victim's existing data - instead the victim is silently authenticated into the ATTACKER's Airflow account, so subsequent work the victim performs lands in a session the attacker controls. This inverts the usual CSRF threat model and its real impact is confidentiality/integrity of the victim's future actions (data exfiltration of whatever the victim subsequently enters, or manipulation of their workflow) rather than takeover of the victim's own account. Real-world priority is tempered by three limiting factors all drawn from the description: exploitation requires the specific AWS auth manager + SAML configuration (not Airflow's default auth), it requires victim user interaction (loading an attacker page), and no public exploit is identified. There is NO conflicting data to reconcile because no machine signals were provided - the key gap to flag is that EPSS, KEV, POC and a CVSS vector are all MISSING from input and should be verified against NVD/CISA before final prioritization. This is a credible but conditional issue: a real fix-worthy bug for the affected SAML deployments, not a broad internet-wide emergency.

An attacker performs their own SAML login against a target Airflow instance to obtain a valid assertion, then lures an authenticated-intending victim to an attacker-controlled web page that auto-submits that assertion to the Airflow SAML callback. Because the callback does not require a matching InResponseTo, the victim's browser is silently logged into the ATTACKER's account, and any DAGs, connections, variables, or credentials the victim then configures become visible to and controllable by the attacker. No public exploit is identified at time of analysis, though the fixing pull request (apache/airflow#73698) is public.