Apache Airflow Fab Provider (Apache Software Foundation) - vulnerabilities (CVEs)
9 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-16. Vendor: Apache Software Foundation.
CVEs of Apache Airflow Fab Provider
- CVE-2026-86466 - CVSS 8.1 (high), 2026-09-16: Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An…
- CVE-2026-82310 - CVSS 7.2 (high), 2026-09-16: Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly…
- CVE-2026-86462 - CVSS 9.1 (critical), 2026-09-16: Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed…
- CVE-2026-82311 - CVSS 9.8 (critical), 2026-09-16: Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it…
- CVE-2026-75156 - CVSS 9.1 (critical), 2026-09-08: Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are…
- CVE-2026-59243 - CVSS 9.8 (critical), 2026-07-29: The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned…
- CVE-2026-59245 - CVSS 8.1 (high), 2026-07-13: In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by…
- CVE-2026-46745 - CVSS 5.3 (medium), 2026-05-25: Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or…
- CVE-2024-45033 - CVSS 8.1 (high), 2025-01-08: Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password…
