Apache Software Foundation Apache Airflow FAB provider
CVE-2026-86466High 8.1Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated0.4%
CVE-2026-82310High 7.2Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access1.0%
CVE-2026-86462Critical 9.1Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions0.8%
CVE-2026-82311Critical 9.8Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false1.0%
CVE-2026-75156Critical 9.1Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass0.4%
CVE-2026-59243Critical 9.8Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)0.6%
CVE-2026-59245High 8.1Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)0.6%
CVE-2026-46745Medium 5.3Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token0.6%
CVE-2024-45033High 8.1Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli1.0%