CVE-2026-46745Medium· 5.3▾ SunlitApache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
0.6% → 0.6%
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.
apache-airflow-providers-fab < 3.6.4Upgrade to a patched release:
apache-airflow-providers-fab 3.6.4Connected by shared product, vendor, weakness, or advisory.
CVE-2024-45033LowApache Airflow Fab Provider Insufficient Session Expiration vulnerability
CVE-2024-42447Medium· 4.2Apache Airflow Providers FAB Insufficient Session Expiration vulnerability
CVE-2026-59245High· 8.1In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently gran…
CVE-2026-82310High· 7.2Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
CVE-2026-86466High· 8.1Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts
CVE-2026-86462Critical· 9.1Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions