CVE-2026-75156

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in Apache Airflow FAB Provider

Publication date: 2026-09-08

Last updated on: 2026-09-18

Assigner: Apache Software Foundation

Description

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-18

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-75156

Affected Vendors & Products

Vendor	Product	Version / Range
apache	apache-airflow-providers-fab	From 3.7.3 (inc) to 3.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability affects Apache Airflow FAB provider versions 3.7.3 through 3.8.0 when configured with Azure AD OAuth. It allows attackers to authenticate to the Airflow UI by using tokens from any Azure tenant, including ones they create, due to missing issuer and audience validation in the Azure AD id_token.

Impact Analysis

An attacker could gain unauthorized access to the Airflow UI, potentially leading to data breaches, unauthorized actions, or control over the system. This is possible even without prior access to the deployment if the attacker registers an Azure tenant.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches and lack of proper access controls.

Mitigation Strategies

Upgrade to apache-airflow-providers-fab version 3.8.1 or later to address the incomplete fix for CVE-2026-59243. Verify the FAB auth manager configuration for Azure AD OAuth provider and ensure issuer and audience checks are enforced.

Hi! I’m here to help you understand CVE-2026-75156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70