EUVD-2026-10319

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

airflow-poetry-test (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (3.4.0)

apache-airflow-providers-amazon PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-poetry-test =0.1.0, =0.1.2 Source cves: CVE-2026-25604 Source advisory:...

flowui-project (>=0.0.1, <=0.0.13) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (4.0.0)

apache-airflow-providers-amazon PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - flowui-project =0.0.1, =0.0.13 Source cves: CVE-2026-25604 Source advisory: OSV:GHSA-RV5F-CCPM-XJJ...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (3.2.0)

apache-airflow-providers-amazon PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-25604 Source advisory:...

airflow-aws-shared-secrets (>=0.0.1, <=0.0.5), airflow-tools (>=0.1.0, <=0.8.6) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.29.0)

apache-airflow-providers-amazon PYPI version 8.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-aws-shared-secrets =0.0.1, =0.1.0, =0.8.6 Source cves: CVE-2026-25604 Source advisory:...

example-pkg-naturalett (>=14.4.0, <=14.4.8) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (2.0.0)

apache-airflow-providers-amazon PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.8 Source cves: CVE-2026-25604 Source advisory:...

airflow-providers (>=0.1.0, <=0.3.0) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (5.1.0)

apache-airflow-providers-amazon PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airflow-providers =0.1.0, =0.3.0 Source cves: CVE-2026-25604 Source advisory: OSV:GHSA-RV5F-CCPM-X...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (1.4.0)

apache-airflow-providers-amazon PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =2.0.0 - example-pkg-naturalett 14.7.0 Source cves: CVE-2026-256...

airgoodies (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (8.7.1)

apache-airflow-providers-amazon PYPI version 8.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-amazon and may be impacted: - airgoodies =0.0.3, =0.0.4 Source cves: CVE-2026-25604 Source advisory: OSV:GHSA-RV5F-CCPM-XJJ4...

CVE-2026-25604

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2), airflow-aws-shared-secrets (>=0.0.1, <=0.0.5) +13 more potentially affected by CVE-2026-25604 via apache-airflow-providers-amazon (>=1.4.0, <=9.17.0)

apache-airflow-providers-amazon PYPI version =1.4.0, =0.2.9b1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.0.3, =0.0.4rc1, =0.0.0, =0.0.1, =2.10.3, =14.4.0, =0.0.1, =0.0.1rc1, =2.10.7rc1, =2.10.11rc5 Source cves: CVE-2026-25604 Source advisory: MEND:CVE-2026-25604...

CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604

The apache-airflow-providers-amazon package (versions 8.0.0 – 9.21.x) is vulnerable to a Host Header Injection in the AWS Auth Manager . The _prepare_flask_request() method fails to validate the client-provided Host header, using it instead to construct the SAML Assertion Consumer Service (ACS) c...

PT-2026-24054

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 9.22.0 Description The AWS Auth Manager in Apache Airflow did not verify the origin of SAML authentication against the actual instance URL, relying instead on information provided by the client. This allowed fo...

PT-2026-24112

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 2.4.5.0 through 2.9.0 Description Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, have a path traversal issue in the AWS S3 uploader implementation. Authenticated users can read arbitrary files from...

Ring doorbells: Won&#8217;t you see my neighbor? (Lock and Code S07E05)

This week on the Lock and Code podcast … On February 8, during the Super Bowl in the United States, countless owners of one of the most popular smart products today got a bit of a wakeup call: Their Ring doorbells could be used to see a whole lot more than they knew. In a commercial that was...

Medium: python

Issue Overview: When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized. CVE-2025-11468 User-controlled...

Medium: libpng

Issue Overview: libpng: An out-of-bounds read vulnerability exists in the pngsetquantize API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to...

Medium: rust

Issue Overview: No CVE was issued for this update. Affected Packages: rust Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update rust or yum update --advisory...