AI analysis
CVE-2026-75156 is an origin-validation flaw (CWE-346) in the Apache Airflow FAB provider, which does not validate the issuer or audience of Azure AD id_tokens during OAuth login. It is triggered when the FAB auth manager is configured with Azure AD as the OAuth provider: because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, an id_token minted in any Azure tenant — including one the attacker registers — passes signature verification, and the username and role assignments in that attacker-controlled token are accepted. An attacker with no prior access to the deployment can therefore authenticate to the Airflow UI as an arbitrarily chosen user/role, gaining whatever access those assignments grant. Affected versions are 3.7.3 through 3.8.0, including every release containing the earlier CVE-2026-59243 signature-verification fix, so operators who already patched for that issue remain exposed and must upgrade again. No public proof-of-concept or known exploitation has been reported (EPSS 0.2%, not in CISA KEV).
What to do: Upgrade apache-airflow-providers-fab to 3.8.1 or later; note that the CVE-2026-59243 fix (first shipped in 3.7.3) is incomplete and a second upgrade is required. Until patched, restrict network exposure of the Airflow UI and review whether attacker-supplied username/role claims could grant privileged accounts. Deployments that do not use the FAB auth manager with Azure AD as the OAuth provider are not affected.
Affected
| Apache Airflow FAB provider (apache-airflow-providers-fab) — deployments using the FAB auth manager with Azure AD as OAuth prov | 3.7.3 through 3.8.0 (fixed in 3.8.1) |
Estimated exposure
large≈ tens of thousands of deployments (the subset of Airflow's large self-hosted install base that runs the FAB auth manager with Azure AD OAuth) — Public PyPI download volumes for the FAB provider indicate tens of thousands of active Airflow deployments worldwide, but only the fraction configured for Azure AD OAuth login is affected, so this order of magnitude is an estimate rather…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.