{"id":"CVE-2026-46745","aliases":["GHSA-g283-w6fp-c4fc","PYSEC-2026-2366"],"title":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability","summary":"Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"apache-airflow-providers-fab","product":"apache-airflow-providers-fab","ecosystem":"pip","affected":["apache-airflow-providers-fab < 3.6.4"],"patched":["apache-airflow-providers-fab 3.6.4"],"published":"2026-05-26","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-g283-w6fp-c4fc","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46745"},{"url":"https://github.com/apache/airflow/pull/66417"},{"url":"https://github.com/apache/airflow/commit/3f7756bea71a7c7988511ec0557314ffb15fbe5e"},{"url":"https://github.com/apache/airflow"},{"url":"https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/24/10"}],"tags":["osv","pip"],"epss":0.00575,"epssPercentile":0.45925,"ingestedAt":"2026-07-13T18:57:57.993Z","slug":"CVE-2026-46745","body":"## Overview\n\nApache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.\n\n## Affected packages\n\n- `apache-airflow-providers-fab < 3.6.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-airflow-providers-fab 3.6.4`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}