Apache Apache-airflow-providers-fab vulnerabilities

• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated CVE-2026-86466 8.1 HighSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access CVE-2026-82310 7.2 HighSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CVE-2026-86462 9.1 CriticalSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false CVE-2026-82311 9.8 CriticalSeptember 16, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass CVE-2026-75156 9.1 CriticalSeptember 8, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) CVE-2026-59243 Public exploit 9.8 CriticalJuly 29, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) CVE-2026-59245 8.1 HighJuly 13, 2026
• apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 more Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token CVE-2026-46745 Fix available 5.3 MediumMay 25, 2026
• apache software foundation airflow fab provider, apache apache-airflow-providers-fab +1 more Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli CVE-2024-45033 Fix available 8.1 HighJanuary 8, 2025
• apache software foundation airflow providers fab, apache apache-airflow-providers-fab +1 more Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow CVE-2024-42447 Fix available 9.8 CriticalAugust 5, 2024