CVE-2026-86467— Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Quick assessment
Affected
Apache Software Foundation Apache Airflow Amazon provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Airflow Amazon 提供商漏洞：AWS 身份验证管理器（AWS Auth Manager）的 SAML 登录流程未将身份验证响应绑定到发起该请求的浏览器。登录处理器会丢弃 AuthnRequest ID，而回调验证断言时并未要求匹配 InResponseTo 字段。因此，未认证的攻击者若能诱使受害者加载某个页面，即可利用攻击者自身的断言，在受害者的浏览器中完成 SAML 登录，从而在受害者无感知的情况下将其登录到攻击者的 Airflow 账户。受害者随后执行的所有操作都将落入由攻击者控制的会
Possible ATT&CK Techniques 2 AI
T1055.004 · Asynchronous Procedure Call T1566.002 · Spearphishing Link
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86467
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim's browser using the attacker's own assertion, silently logging the victim into the attacker's Airflow account. Subsequent work the victim performs lands in a session the attacker controls.
Affects deployments using the AWS auth manager with SAML authentication. The victim needs only to visit an attacker-controlled page; no Airflow account or credential is required of the attacker. This is the same login-CSRF class fixed in the Keycloak auth manager as CVE-2026-40948.
Users of apache-airflow-providers-amazon are recommended to upgrade to version 9.38.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow Amazon provider | 0 ~ 9.38.0 | - |
|
II. Public POCs for CVE-2026-86467
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86467
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86467 (1)
Vendor Advisories for CVE-2026-86467 (1)
-
🔗 CVE Record: CVE-2026-40948 related
Mailing List Discussions for CVE-2026-86467 (1)
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-92287
Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL i -
CVE-2026-88900
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of -
CVE-2026-91858
Apache Camel: Camel-FOP Resolves External DTDs and Entities -
CVE-2026-88901
Apache Camel: Camel-Smooks XML External Entity Processing, e -
CVE-2026-85317
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under
Same weakness: CWE-352
-
CVE-2026-111883
Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset -
CVE-2026-110008
@fastify/oauth2 vulnerable to Login CSRF via OAuth state coo -
CVE-2026-84178
Apache Camel: Camel-OAuth Login Cross-Site Request Forgery v -
CVE-2026-112033
aircheng-org iWebShop-5 Password Change system.php admin_rep -
CVE-2026-111988
dyad-sh dyad OAuth Callback cross-site request forgery
V. Comments for CVE-2026-86467
No comments yet