CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.
CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.
- Affects apache-airflow-providers-fab before 3.9.0
- id_token issuer and audience claims not validated
- Tokens minted for other Authentik clients authenticate to Airflow
- Fixed in FAB provider 3.9.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86466 | Missing id_token audience validation in Apache Airflow FAB provider Authentik OAuth | 8.1 | — |
From the original article
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) before 3. 9. 0 Description: Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.