CVE-2024-45033

The Apache Airflow Fab Provider is vulnerable to an insufficient session expiration issue in versions prior to 1.5.2 . When a user's password is changed via the admin CLI , existing sessions for that user are not cleared. This allows authenticated users to maintain their session and continue acce...

CVE-2026-46745

The Apache Airflow FAB Auth Manager is susceptible to an LDAP filter injection vulnerability (CWE-90). This flaw allows unauthenticated attackers to potentially bypass authentication or exfiltrate directory data . To remediate this issue, users should upgrade to apache-airflow-providers-fab 3.6.4...

CVE-2026-59243

The apache-airflow-providers-fab component in Apache Airflow is vulnerable to an authentication bypass due to the FAB auth manager's Azure AD OAuth login defaulting verify_signature=False when decoding ID tokens. An attacker can present a forged or unsigned (alg:none) ID token to the OAuth callba...

CVE-2026-59245

The CVE affects Apache Airflow FAB provider: FAB auth manager. A DAG with dag_id/DAGs collides with the global all-DAGs permission name produced by resource_name(), causing a per-DAG access_control grant on that DAG to silently confer the global all-DAGs permission. This yields privilege escalati...

CVE-2026-86466

The apache-airflow-providers-fab package is vulnerable to an Origin Validation Error because the Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of accepted id_tokens. An attacker who possesses a valid token issued by the same Authentik identity provid...