Read the docs
TI-2026-59164 Aliases CVE-2026-86466GHSA-6fx3-rxq6-j8w2

Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Priority LOW 37CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-346.

Summary

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications; the attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here. Deployments that applied the CVE-2026-75156 fix and use Authentik must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed Apache Airflow FAB provider (Apache Software Foundation): 3.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow FAB providerbefore 3.9.03.9.0Patch availableCNA
  • Apache Airflow FAB provider VendorApache Affected before 3.9.0 Fixed in 3.9.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*before 3.9.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:* Versions before 3.9.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow FAB provider (Apache Software Foundation) Fixed in 3.9.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Airflow FAB provider 3.9.0

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB providerPriority MEDIUM 51
    • TI-2026-59161 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsPriority MEDIUM 49
    • TI-2026-56768 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessPriority LOW 36
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86466
  2. 2026-10-03 Alias added: GHSA-6fx3-rxq6-j8w2

References

Patch 1

Advisory 3

  • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2024-28416 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow CVSS 3.1CRITICAL 9.8
  • TI-2026-42383 Improper signature verification in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2026-59161 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CVSS 3.1CRITICAL 9.1
  • TI-2026-52804 Origin validation error in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.1
  • TI-2024-30146 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences