Missing id_token audience validation in Apache Airflow FAB provider Authentik OAuth
The Authentik OAuth login path in Apache Airflow's FAB auth manager (apache-airflow-providers-fab) accepts id_tokens without validating the issuer or audience claims, an origin validation error (CWE-346). An attacker who holds a valid id_token that the same Authentik identity provider minted for any other client application can present it to Airflow and be authenticated as the user the token names. This yields unauthorized access to the Airflow UI/API with the privileges of that user, up to admin in the worst case. Affected deployments are those using the FAB auth manager with Authentik OAuth where the Authentik instance also serves other applications; deployments that already applied the CVE-2026-75156 fix (the same missing validation on the Azure AD path) remain vulnerable on the Authentik path. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is reported, and no CVSS score has been assigned yet.
What to do: Upgrade apache-airflow-providers-fab to version 3.9.0 or later; deployments that patched CVE-2026-75156 for the Azure AD path must still apply this update for the Authentik path. Until patched, consider disabling Authentik OAuth login on the FAB auth manager or isolating Airflow on a dedicated Authentik instance/tenant, and review Airflow authentication/audit logs for logins where the presented token's client (azp/aud) does not correspond to the Airflow application.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Airflow FAB provider (apache-airflow-providers-fab), FAB auth manager Authentik OAuth configuration | All versions prior to 3.9.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications; the attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here. Deployments that applied the CVE-2026-75156 fix and use Authentik must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.
Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.
Today 1.6K readers · 2.5K views · 792 reads · all time 189K views