CVE-2026-59243

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Apache Airflow FAB Azure AD OAuth

Publication date: 2026-07-29

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-05

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-59243

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache-airflow-providers-fab	to 3.7.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves the FAB auth manager's Azure AD OAuth login using a default setting of verify_signature=False when decoding ID tokens. This allows attackers to bypass authentication by presenting a forged or unsigned token with alg:none, potentially logging in as any user including an Admin.

Detection Guidance

Check the installed version of apache-airflow-providers-fab. If it is below 3.7.3, the system is vulnerable. Run: pip show apache-airflow-providers-fab or pip list | grep apache-airflow-providers-fab to verify the version.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system as any user, including those with administrative privileges. This could lead to data breaches, unauthorized actions, or full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade apache-airflow-providers-fab to version 3.7.3 or later. This ensures verify_signature defaults to True, preventing forged or unsigned tokens from bypassing authentication.

Hi! I’m here to help you understand CVE-2026-59243. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70