CVE-2026-86467

The Apache Airflow Amazon provider is vulnerable to a login-CSRF attack via the AWS auth manager 's SAML login flow. The vulnerability occurs because the login handler discards the AuthnRequest ID and the callback validates assertions without requiring a matching InResponseTo value. This allows a...