Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-75156: Apache Airflow FAB provider allows unauthorized login via Azure AD
CVE-2026-75156 · published 1 month ago
Summary
Versions of the Apache Airflow FAB provider that use Azure AD for sign‑in do not check that the token comes from the correct Azure tenant or is meant for your system. This lets anyone who can create an Azure tenant craft a token and gain access to the Airflow web interface. Upgrade the FAB provider to version 3.8.1 or newer to add the missing checks.
What to do
- Update apache software foundation apache airflow fab provider to version 3.8.1 or later.
- Update apache apache-airflow-providers-fab to version 3.8.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache airflow fab provider | < 3.8.1 |
| apache | apache-airflow-providers-fab |
>= 3.7.3, < 3.8.1 cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:* |
Original advisory text
Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment.
The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.
The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.
References
- https://github.com/apache/airflow/pull/71735 Patch Vendor Advisory
- https://lists.apache.org/thread/n3l6z4jfdxj4p0t8l7m6olkq6xsc6f76 Mailing List
- https://pypi.python.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75156... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-75156 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-59243 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-346Origin Validation Error
Timeline
Published8 Sep 2026
Updated7 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta