Apache Apache-Airflow-Providers-Fab vulnerabilities

10 CVEs affecting Apache Apache-Airflow-Providers-Fab, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86466, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-82310, published 2026-09-16. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core…
CVE-2024-45033, published 2025-01-08. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the…
CVE-2026-82311, published 2026-09-16. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string…
CVE-2024-42447, published 2024-08-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all…
CVE-2026-86462, published 2026-09-16. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a…
CVE-2026-46745, published 2026-05-25. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to…
CVE-2026-59243, published 2026-07-29. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth…
CVE-2026-59245, published 2026-07-13. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG…
CVE-2026-75156, published 2026-09-08. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is…
CVE-2026-86466, published 2026-09-16. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same…