Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Apache Airflow Fab Provider — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in Apache Airflow Fab Provider, with AI-generated Chinese analysis, references, and POCs.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated CWE-346 - - 2026-09-16
CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access CWE-613 - - 2026-09-16
CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CWE-613 - - 2026-09-16
CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false CWE-613 - - 2026-09-16
CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass CWE-346 - - 2026-09-08
CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) CWE-347 - - 2026-07-29
CVE-2026-59245 Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) CWE-269 - - 2026-07-13
CVE-2026-46745 Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token CWE-90 - - 2026-05-25
CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli CWE-613 8.8 - 2025-01-08

All 9 known CVE vulnerabilities affecting Apache Airflow Fab Provider with full Chinese analysis, references, and POCs where available.