| CVE-2026-86466 |
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-82310 |
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-86462 |
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-82311 |
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-75156 |
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD…
|
Not rated
|
Sep 8, 2026 |
| CVE-2026-59243 |
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an…
|
Not rated
|
Jul 29, 2026 |
| CVE-2026-59245 |
In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission…
|
Not rated
|
Jul 13, 2026 |
| CVE-2026-46745 |
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated…
|
Not rated
|
May 25, 2026 |
| CVE-2024-45033 |
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider
|
Not rated
|
Jan 8, 2025 |