Read the docs
TI-2026-76713 Aliases CVE-2026-86467GHSA-2738-4g2m-64cv

Login CSRF in Apache Airflow AWS auth manager SAML login

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.

Summary

Apache Airflow Amazon provider versions before 9.38.0 use the AWS auth manager with SAML authentication. The SAML login flow does not bind the authentication response to the browser that started it, which is a cross-site request forgery flaw (CWE-352). An unauthenticated attacker who gets a victim to load an attacker-controlled page can log the victim's browser into the attacker's Airflow account using the attacker's own assertion.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim's browser using the attacker's own assertion, silently logging the victim into the attacker's Airflow account. Subsequent work the victim performs lands in a session the attacker controls. Affects deployments using the AWS auth manager with SAML authentication. The victim needs only to visit an attacker-controlled page; no Airflow account or credential is required of the attacker. This is the same login-CSRF class fixed in the Keycloak auth manager as CVE-2026-40948. Users of apache-airflow-providers-amazon are recommended to upgrade to version 9.38.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Fixed Apache Airflow Amazon provider (Apache Software Foundation): 9.38.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow Amazon providerbefore 9.38.09.38.0Patch availableCNA
  • Apache Airflow Amazon provider VendorApache Affected before 9.38.0 Fixed in 9.38.0 Patch available CNA

Remediation

Upgrade apache-airflow-providers-amazon to version 9.38.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Apache Airflow Amazon provider (Apache Software Foundation) Fixed in 9.38.0

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-86467
  2. 2026-10-29 CVSS score added · CISA ADP
  3. 2026-10-29 CISA SSVC decision points changed
  4. 2026-10-29 Alias added: GHSA-2738-4g2m-64cv
  5. 2026-10-31 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences