Not rated
CVE-2026-46745 Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated…
Description
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Airflow Fab Provider 3.6 | earliest → < 3.6.4 | 3.6.4 |
References
- github.com github.com
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Airflow Fab Provider
The 9 CVEs of Apache Airflow Fab Provider →
CVE-2026-86466
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience…
Not rated
CVE-2026-82310
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
Not rated
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate…
Not rated
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed…
Not rated