Non notée
CVE-2026-46745 Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated…
Description
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Airflow Fab Provider 3.6 | premières → < 3.6.4 | 3.6.4 |
Références
- github.com github.com
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Airflow Fab Provider
Les 9 CVE de Apache Airflow Fab Provider →
CVE-2026-86466
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience…
Non notée
CVE-2026-82310
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
Non notée
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate…
Non notée
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed…
Non notée