CVE-2026-25604-PoC

CVE-2026-25604 PoC Apache Airflow 的 AWS Auth Manager 中，Host 头注入导致 SAML 身份验证绕过 攻击者可以在 SAML 登录流程中注入恶意的 Host 头，使断言使用者服务（ACS）URL 指向攻击者控制的服务器。这使攻击者能够捕获有效的 SAML 响应 并重放这些响应以未授权访问 受害者的 Airflow 实例——或在不同访问控制的多个 Airflow 实例间重用令牌。 受影响版本 软件包| 受影响版本| 修复版本 ---|---|--- apache-airflow-providers-amazon| 8.0.0 –...

PYSEC-2026-2363 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

GHSA-RV5F-CCPM-XJJ4 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...