CVE-2026-46745: Apache Apache-Airflow-Providers-Fab

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Affected products

• Apache Apache-Airflow-Providers-Fab: before 3.6.4 (fixed in 3.6.4)

Published 2026-05-25. Last modified 2026-07-23.