CVE-2026-81930— Apache Airflow Snowflake provider 令牌重定向漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Airflow Snowflake provider
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Airflow 的 Snowflake 提供程序（provider）在将连接配置中的 和 字段插入请求 URL 之前，未对其进行任何验证。SQL API 端点的 URL 格式为 。如果 值中包含 、 或 字符，原本预期的域名部分就会被降级为路径、查询参数或片段标识符（fragment），从而使攻击者能够完全控制请求的实际目标主机。 该提供程序在发送此类请求时，会携带一个 头部，其中包含基于连接私钥签发的 JWT（JSON Web Token），或配置好的 OAuth 令牌/编程访问令牌。 在以下场景中
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-81930 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
来源: CVE Program / CVE List V5
Vulnerability Description
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host.
The provider sends that request with an `Authorization: Bearer` header carrying a JWT minted from the connection's private key, or the configured OAuth or programmatic access token. A user who can edit the Snowflake connection but cannot read its secrets — Airflow gives connection-configuration users write-only access to stored credentials, and a `private_key_file` lives on the worker rather than in the connection — can therefore cause a valid token for the account to be delivered to a host of their choosing and replay it against the genuine Snowflake endpoint. No Dag-authoring ability is required: the attacker edits the connection and waits for an existing Dag to use it. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL.
Affects deployments where Snowflake connections are editable by users who are not trusted with the connection's credentials. Users are advised to upgrade to `apache-airflow-providers-snowflake` `6.18.0` or later, which rejects `account` and `region` values containing anything other than letters, digits, `.`, `_` and `-` in every URL the provider builds from them.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow Snowflake provider | 0 ~ 6.18.0 | - |
|
二、漏洞 CVE-2026-81930 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-81930 的情报信息
请登录查看更多情报信息。
CVE-2026-81930 其他参考 (2)
-
https://lists.apache.org/thread/324jm2mxd5x4nq85jfw1ostz94xwzrmk vendor-advisory
同批安全公告 · Apache Software Foundation · 2026-09-29 · 共 18 条
| CVE-2026-102496 | Apache XMLSchema: Denial of service through deeply nested schema structures | |
| CVE-2026-91012 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalatio | |
| CVE-2026-91048 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege esc | |
| CVE-2026-91085 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin | |
| CVE-2026-92142 | Apache Karaf: Authorization bypass in JMX MBean lifecycle operations | |
| CVE-2026-81914 | Apache Airflow Google provider 查询注入漏洞 | |
| CVE-2026-81862 | Airflow Teradata插件云存储凭据泄露漏洞 | |
| CVE-2026-86843 | Airflow Teradata插件SQL注入漏洞 | |
| CVE-2026-102495 | Apache XMLSchema: Denial of service through unbounded recursion when resolving schema impo | |
| CVE-2026-71897 | Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and ba | |
| CVE-2026-102497 | Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker | |
| CVE-2026-66083 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasourc | |
| CVE-2026-82804 | Apache DolphinScheduler 告警脚本命令注入漏洞 | |
| CVE-2026-81569 | Apache DolphinScheduler 子任务工作流未授权执行漏洞 | |
| CVE-2026-78214 | Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths | |
| CVE-2026-71899 | Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to | |
| CVE-2026-71898 | Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-71897
Apache DolphinScheduler: Allows unauthorized workflow operat -
CVE-2026-71898
Apache DolphinScheduler: Improper Authorization Allows Proje -
CVE-2026-71899
Apache DolphinScheduler: Missing Authorization in query-dyna -
CVE-2026-78214
Apache DolphinScheduler: Actuator Endpoint Authentication By -
CVE-2026-81569
Apache DolphinScheduler 子任务工作流未授权执行漏洞
V. Comments for CVE-2026-81930
暂无评论