Apache Airflow Providers Fab
Monthly
Authentication bypass in the Apache Airflow FAB provider (apache-airflow-providers-fab before 3.9.0) allows an attacker who holds an OIDC id_token that the same Authentik identity provider minted for a different client application to log into Airflow as the named user, because the Authentik OAuth path in the FAB auth manager never validates the token's issuer or audience claims. Only deployments using the FAB auth manager with Authentik OAuth are affected, and only where that same Authentik instance also serves at least one other application, so the attacker must already possess a valid token from that other application (the assessed vector is AV:N/AC:H/PR:L/UI:N, reflecting these gated prerequisites). Risk is high on confidentiality and integrity for exposed deployments, but the exploit path is narrow; no public exploit has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so this is a strongly gated authentication-bypass issue rather than a broad remote-takeover vector.
Insufficient session expiration in apache-airflow-providers-fab 2.4.2 through 3.9.0 means an attacker who already holds a copy of a victim's valid session cookie retains authenticated access to Apache Airflow even after an administrator (or the user) performs a password reset as a containment step. The flaw affects only deployments using the FAB auth manager with `[fab] session_backend=database`, where the reset routine compares the string identifier Flask-Login stores in server-side session records against the user's integer database ID, so the comparison never matches and no session is actually deleted; this is a persistence/containment-bypass issue rather than a standalone break-in, since the attacker must have obtained the cookie through some prior compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the vendor's CVSS of 9.8 conflicts with the assessed vector (AV:N/AC:H/PR:N/UI:N), which reflects the substantial preconditions - a non-default session backend plus a pre-existing cookie theft. A single upgrade to apache-airflow-providers-fab 3.9.0 or later also closes CVE-2026-86462, a second independent route to the same outcome via the Admin user-edit endpoint.
Stolen database-backed session cookies keep working after a password change in Apache Airflow deployments that use the FAB auth manager (apache-airflow-providers-fab 3.2.0 through 3.9.0), so an attacker already holding a copy of a victim's session cookie is never evicted and retains full access as that user. The flaw is CWE-613 (insufficient session expiration): the Admin user-edit PATCH endpoint applies the new password but never calls the session-invalidation helper, and the trigger is a routine password change performed by an administrator or the user themselves - no interaction by the attacker is required. The vendor scores this 9.1, while our independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, because exploitation depends entirely on a prior, separate session-cookie theft and on the non-default database-backed session configuration, making this a post-compromise persistence/containment failure rather than an initial access vector. EPSS is low at 0.19% (9th percentile); no public exploit code and no CISA KEV entry were identified at time of analysis, and a vendor-released patch exists in version 3.9.0.
Deactivating a user account in Apache Airflow 3 deployments that run the FAB auth manager with Core API token authentication fails to revoke tokens already issued to that account, so the disabled user can keep replaying an unexpired token - and use it to mint a replacement - after an administrator has turned the account off. The credential is the account's own legitimate token, so there is no signature forgery and no privilege escalation: access stays bounded to the roles the account already held, but the administrative containment action silently fails and the account keeps role-scoped API access until the token finally expires. No public exploit code identified at time of analysis; EPSS is low at 0.25% (16th percentile); a vendor fix is available in apache-airflow-providers-fab 3.9.0.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.5.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Authentication bypass in the Apache Airflow FAB provider (apache-airflow-providers-fab before 3.9.0) allows an attacker who holds an OIDC id_token that the same Authentik identity provider minted for a different client application to log into Airflow as the named user, because the Authentik OAuth path in the FAB auth manager never validates the token's issuer or audience claims. Only deployments using the FAB auth manager with Authentik OAuth are affected, and only where that same Authentik instance also serves at least one other application, so the attacker must already possess a valid token from that other application (the assessed vector is AV:N/AC:H/PR:L/UI:N, reflecting these gated prerequisites). Risk is high on confidentiality and integrity for exposed deployments, but the exploit path is narrow; no public exploit has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so this is a strongly gated authentication-bypass issue rather than a broad remote-takeover vector.
Insufficient session expiration in apache-airflow-providers-fab 2.4.2 through 3.9.0 means an attacker who already holds a copy of a victim's valid session cookie retains authenticated access to Apache Airflow even after an administrator (or the user) performs a password reset as a containment step. The flaw affects only deployments using the FAB auth manager with `[fab] session_backend=database`, where the reset routine compares the string identifier Flask-Login stores in server-side session records against the user's integer database ID, so the comparison never matches and no session is actually deleted; this is a persistence/containment-bypass issue rather than a standalone break-in, since the attacker must have obtained the cookie through some prior compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), but the vendor's CVSS of 9.8 conflicts with the assessed vector (AV:N/AC:H/PR:N/UI:N), which reflects the substantial preconditions - a non-default session backend plus a pre-existing cookie theft. A single upgrade to apache-airflow-providers-fab 3.9.0 or later also closes CVE-2026-86462, a second independent route to the same outcome via the Admin user-edit endpoint.
Stolen database-backed session cookies keep working after a password change in Apache Airflow deployments that use the FAB auth manager (apache-airflow-providers-fab 3.2.0 through 3.9.0), so an attacker already holding a copy of a victim's session cookie is never evicted and retains full access as that user. The flaw is CWE-613 (insufficient session expiration): the Admin user-edit PATCH endpoint applies the new password but never calls the session-invalidation helper, and the trigger is a routine password change performed by an administrator or the user themselves - no interaction by the attacker is required. The vendor scores this 9.1, while our independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, because exploitation depends entirely on a prior, separate session-cookie theft and on the non-default database-backed session configuration, making this a post-compromise persistence/containment failure rather than an initial access vector. EPSS is low at 0.19% (9th percentile); no public exploit code and no CISA KEV entry were identified at time of analysis, and a vendor-released patch exists in version 3.9.0.
Deactivating a user account in Apache Airflow 3 deployments that run the FAB auth manager with Core API token authentication fails to revoke tokens already issued to that account, so the disabled user can keep replaying an unexpired token - and use it to mint a replacement - after an administrator has turned the account off. The credential is the account's own legitimate token, so there is no signature forgery and no privilege escalation: access stays bounded to the roles the account already held, but the administrative containment action silently fails and the account keeps role-scoped API access until the token finally expires. No public exploit code identified at time of analysis; EPSS is low at 0.25% (16th percentile); a vendor fix is available in apache-airflow-providers-fab 3.9.0.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.5.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.