Apache Apache-Airflow-Providers-Fab
10 CVEs affecting Apache Apache-Airflow-Providers-Fab. Latest disclosed: 2026-09-16. Critical: 5, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82311 | Critical | 9.8 | 2026-09-16 | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
CVE-2026-59243 | Critical | 9.8 | 2026-07-29 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned… |
CVE-2024-42447 | Critical | 9.8 | 2024-08-05 | Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache A… |
CVE-2026-86462 | Critical | 9.1 | 2026-09-16 | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
CVE-2026-75156 | Critical | 9.1 | 2026-09-08 | Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are aff… |
CVE-2026-86466 | High | 8.1 | 2026-09-16 | Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An at… |
CVE-2026-59245 | High | 8.1 | 2026-07-13 | In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`… |
CVE-2024-45033 | High | 8.1 | 2025-01-08 | Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user passwor… |
CVE-2026-82310 | High | 7.2 | 2026-09-16 | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rej… |
CVE-2026-46745 | Medium | 5.3 | 2026-05-25 | Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or… |