CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider flaw (CVE-2026-75156) lets attackers bypass Azure AD OAuth token validation via unvalidated issuer and audience claims.
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD id_tokens during OAuth login, enabling cross-tenant authentication bypass. The issue affects deployments where the FAB auth manager is configured with Azure AD as an OAuth provider. A fix is available in version 3.8.1. Severity is rated moderate.
- CVE-2026-75156 rated moderate by maintainers
- Affects FAB provider 3.7.3 through 3.8.0
- Fixed in version 3.8.1
- Only impacts Azure AD OAuth configurations
- CVEs
- CVE-2026-75156
- Vendors
- Apache
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75156 | Cross-tenant authentication bypass in Apache Airflow FAB provider | 9.1 | <1% |
From the original article
Posted by Niko Oliveira on Sep 08 Severity: moderate Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) 3. 7. 3 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.