Read the docs
TI-2026-34366 Aliases CVE-2026-46745GHSA-g283-w6fp-c4fc

Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token

Priority LOW 31CWE-90Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00575 47th percentileScored 2026-11-07
Fix Fixed Apache Airflow FAB provider (Apache Software Foundation): 3.6.4apache-airflow-providers-fab (PyPI): 3.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow FAB providerbefore 3.6.43.6.4Patch availableCNA
—apache-airflow-providers-fab (PyPI)before 3.6.43.6.4Patch availableGHSA-g283-w6fp-c4fc
  • Apache Airflow FAB provider VendorApache Affected before 3.6.4 Fixed in 3.6.4 Patch available CNA
  • apache-airflow-providers-fab (PyPI) Vendor— Affected before 3.6.4 Fixed in 3.6.4 Patch available GHSA-g283-w6fp-c4fc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*before 3.6.4VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:* Versions before 3.6.4 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow FAB provider (Apache Software Foundation) Fixed in 3.6.4
  • Fix · GHSA-g283-w6fp-c4fc apache-airflow-providers-fab (PyPI) Fixed in 3.6.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46745
  2. 2026-10-03 Alias added: GHSA-g283-w6fp-c4fc
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 3

Other 2

  • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2024-28416 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow CVSS 3.1CRITICAL 9.8
  • TI-2026-42383 Improper signature verification in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2026-59161 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CVSS 3.1CRITICAL 9.1
  • TI-2026-52804 Origin validation error in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.1
  • TI-2024-30146 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences