{"id":"CVE-2026-46745","aliases":["EUVD-2026-31669","GHSA-g283-w6fp-c4fc","PYSEC-2026-2366"],"status":"published","title":"Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00575,"percentile":0.47743,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-90"],"published":"2026-05-25T10:41:16Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"PyPI","package":"apache-airflow-providers-fab","fixed_in":["3.6.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow-providers-fab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-fab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4"}]}],"versions":["1.0.0","1.0.0rc1","1.0.1","1.0.1.dev0","1.0.2","1.0.2.dev0","1.0.2.dev1","1.0.2.dev2","1.0.2b0","1.0.2rc1","1.0.3","1.0.3rc1","1.0.4","1.0.4rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.2.2","1.2.2rc1","1.3.0","1.3.0rc1","1.4.0","1.4.0rc1","1.4.1","1.4.1rc1","1.5.0","1.5.0rc1","1.5.0rc2","1.5.0rc3","1.5.1","1.5.1rc1","1.5.2","1.5.2rc1","1.5.3","1.5.3rc1","1.5.4","1.5.4rc1","2.0.0","2.0.0b1","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.1","2.0.1rc1","2.0.2","2.0.2rc1","2.0.2rc2","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","2.2.1","2.2.1rc1","2.2.1rc2","2.3.0","2.3.0rc1","2.3.1","2.3.1rc1","2.4.0","2.4.0rc1","2.4.1","2.4.1rc1","2.4.2","2.4.2rc1","2.4.3","2.4.3rc1","2.4.4","2.4.4rc1","3.0.0","3.0.0rc1","3.0.0rc2","3.0.1","3.0.1rc1","3.0.2","3.0.2rc1","3.0.3","3.0.3rc1","3.1.0","3.1.0rc1","3.1.1","3.1.1rc1","3.1.2","3.1.2rc1","3.2.0","3.2.0rc1","3.3.0","3.3.0rc1","3.4.0","3.4.0rc1","3.5.0","3.5.0rc1","3.6.0","3.6.0rc1","3.6.1","3.6.1rc1","3.6.2","3.6.2rc1","3.6.3","3.6.3rc1","3.6.4rc1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-fab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4"}]}],"versions":["1.0.0","1.0.0rc1","1.0.1","1.0.1.dev0","1.0.2","1.0.2.dev0","1.0.2.dev1","1.0.2.dev2","1.0.2b0","1.0.2rc1","1.0.3","1.0.3rc1","1.0.4","1.0.4rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.2.2","1.2.2rc1","1.3.0","1.3.0rc1","1.4.0","1.4.0rc1","1.4.1","1.4.1rc1","1.5.0","1.5.0rc1","1.5.0rc2","1.5.0rc3","1.5.1","1.5.1rc1","1.5.2","1.5.2rc1","1.5.3","1.5.3rc1","1.5.4","1.5.4rc1","2.0.0","2.0.0b1","2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.1","2.0.1rc1","2.0.2","2.0.2rc1","2.0.2rc2","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","2.2.1","2.2.1rc1","2.2.1rc2","2.3.0","2.3.0rc1","2.3.1","2.3.1rc1","2.4.0","2.4.0rc1","2.4.1","2.4.1rc1","2.4.2","2.4.2rc1","2.4.3","2.4.3rc1","2.4.4","2.4.4rc1","3.0.0","3.0.0rc1","3.0.0rc2","3.0.1","3.0.1rc1","3.0.2","3.0.2rc1","3.0.3","3.0.3rc1","3.1.0","3.1.0rc1","3.1.1","3.1.1rc1","3.1.2","3.1.2rc1","3.2.0","3.2.0rc1","3.3.0","3.3.0rc1","3.4.0","3.4.0rc1","3.5.0","3.5.0rc1","3.6.0","3.6.0rc1","3.6.1","3.6.1rc1","3.6.2","3.6.2rc1","3.6.3","3.6.3rc1","3.6.4rc1"]}],"products":[{"vendor":"apache","product":"apache-airflow-providers-fab"},{"vendor":"apache software foundation","product":"apache airflow fab provider"}],"references":[{"url":"https://github.com/apache/airflow/pull/66417","tags":["patch","Issue Tracking","Patch","fix","web"]},{"url":"https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/24/10","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46745","tags":["advisory"]},{"url":"https://github.com/apache/airflow/commit/3f7756bea71a7c7988511ec0557314ffb15fbe5e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g283-w6fp-c4fc","tags":["advisory"]},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46745.json","tags":["advisory"]},{"url":"https://github.com/apache/airflow","tags":["package"]},{"url":"https://pypi.org/project/apache-airflow-providers-fab","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-46745","title":"Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-05-25T10:41:16.676Z","modified":"2026-05-26T20:08:17.281Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T13:46:55.086623Z"}],"euvd":[{"id":"EUVD-2026-31669","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-05-25T10:41:16Z","modified":"2026-05-26T20:08:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:06.423934Z"}],"ghsa":[{"id":"GHSA-g283-w6fp-c4fc","title":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-05-26T13:30:41Z","modified":"2026-06-30T16:59:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T14:40:35.701766Z"}],"nvd":[{"id":"CVE-2026-46745","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-05-25T11:16:18.407Z","modified":"2026-07-23T17:10:00.123Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-46745","title":"Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-05-25T10:41:16.676Z","modified":"2026-10-28T02:31:09.502954354Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"GHSA-g283-w6fp-c4fc","title":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-05-26T13:30:41Z","modified":"2026-07-13T16:43:15.451302001Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-90"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"PYSEC-2026-2366","title":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability","description":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.","status":"published","published":"2026-07-13T15:19:12.107945Z","modified":"2026-07-13T16:31:27.898328434Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}