CVE-2026-59243
The FAB auth manager's Azure AD OAuth login incorrectly disabled signature verification for ID tokens, allowing an attacker to present a forged or unsigned token and authenticate as any user, including administrators. This flaw affects apache-airflow-providers-fab versions prior to 3.7.3. Upgrading to version 3.7.3 or later restores proper signature verification and mitigates the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of apache-airflow-providers-fab with Azure AD OAuth login enabled.
Real-world impact
An attacker could bypass authentication and gain privileged access to affected Airflow deployments.
Why this severity
CVSS 9.8 (Critical) due to network‑adjacent, low‑complexity attack requiring no privileges or user interaction, leading to full compromise of confidentiality, integrity, and availability.
What to do about it
- 011. Determine the installed version of apache-airflow-providers-fab.
- 022. If the version is older than 3.7.3, upgrade to version 3.7.3 or newer (e.g., via pip install --upgrade apache-airflow-providers-fab==3.7.3).
- 033. After upgrading, restart any Airflow services or workers to ensure the new library is loaded.
NVD description (vendor advisory) stating that versions before 3.7.3 are affected and that upgrading to 3.7.3 fixes the issue.
Timeline
- Jul 29, 2026 · 1d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 20h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.