CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

CVE-2026-75156

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience of Azure AD id_tokens during OAuth login. Because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, a token minted in any Azure tenant—including one an attacker creates—passes sig...

CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

GHSA-FGCH-86X8-FV43 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-49486 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-8G6F-QW9X-4Q6Q vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-15736 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-2R5M-76WX-56GX vulnerabilities

Vulnerabilities for packages: airflow, airflow-core...

CVE-2026-45360 vulnerabilities

Vulnerabilities for packages: airflow, airflow-core...

GHSA-5CC2-282F-JJQ2 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, mlrun, airflow, mlrun-fips, datadog-agent, keep-fips, keep...

CVE-2026-15925 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, mlrun, airflow, mlrun-fips, datadog-agent, keep-fips, keep...

CLEANSTART-2026-LT04051 Security fixes in airflow-3 3.3.1-r1

Package airflow-3 version 3.3.1-r1 fixes 6 vulnerabilities: CVE-2026-69247, CVE-2026-69248, CVE-2026-69249, CVE-2026-59884, CVE-2026-59885...

Airflow Experimental <1.10.11 - REST API Auth Bypass

Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. id: CVE-2020-13927 info: name: Airflow Experimental 1.10.11 - REST API Auth Bypass author: pdteam severity: critical description: | Airflow's Experimental API prior 1.10.11 allows all API requests without...

GHSA-VXJ7-4XRP-5VR4 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-55558 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-54591 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-2WXC-X7RJ-HG8F vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-54590 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-QR67-GV47-XWWH vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-F2FF-P2WW-7P4P vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-placement-2026.1-fips, openstack-glance-2025.2-fips, mlflow, openstack-horizon-2025.1-fips, openstack-keystone-2025.1, openstack-glance-2025.1-fips, superset, openstack-keystone-2025.2-fips, pgadmin4, openstack-horizon-2026.1-fips...