Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Airflow Amazon provider before 9.38.0 has SAML login CSRF (CVE-2026-86467)

Original title: CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

oss-security ()1
Read at seclists.org
AI summary · x-ai/grok-4.7Summaries by Vani AI

The AWS auth manager accepts a SAML assertion without matching it to the browser that started login.

Apache Airflow Amazon provider before 9.38.0 rates CVE-2026-86467 moderate. Its AWS auth manager SAML login flow does not bind the authentication response to the browser that began it: the login handler discards the AuthnRequest ID, and the callback validates the assertion without requiring a matching InResponseTo. An unauthenticated attacker who can make a victim load attacker-controlled content can log that user into the attacker's account. The posted description is cut off.

Unconfirmed: The mailing-list description is truncated, so effects beyond the login CSRF are not fully stated.

Key facts
  • Jarek Potiuk posted the report on October 19.
  • Affected releases are Apache Airflow Amazon provider before 9.38.0.
  • The flaw is rated moderate.
  • No exploitation is mentioned in the post.
Security assessment · AI, from the article

Impact: Logs the victim into the attacker's account

ProductAffectedFixed in
Apache Airflow Amazon providerbefore 9.38.09.38.0
What to do
  1. 1.Upgrade the Apache Airflow Amazon provider to 9.38.0 or later.
Analyze CVE-2026-86467 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-86467
Tags
apache-airflowawssamlcsrfamazon-provider
Vendors
Apache
Products
Apache Airflow Amazon provider

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86467
Apache Airflow Amazon provider
8.8—

From the original article

Posted by Jarek Potiuk on Oct 19 Severity: moderate Affected versions: - Apache Airflow Amazon provider before 9. 38. 0 Description: Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.