30
35
30
30
30
35
30
30
30
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.
CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.
30
30
30
30
30
30
30
30
30
30
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider flaw (CVE-2026-75156) lets attackers bypass Azure AD OAuth token validation via unvalidated issuer and audience claims.
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD id_tokens during OAuth login, enabling cross-tenant authentication bypass. The issue affects deployments where the FAB auth manager is configured with Azure AD as an OAuth provider. A fix is available in version 3.8.1. Severity is rated moderate.
45
30
30
30
30
30
30
35
30
Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls
Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.
Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.
45
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Wiz disclosed a GitHub Actions workflow injection in Snowflake's snowflake-connector-net repo that exposed Jira API tokens; Snowflake patched the flaw.
Wiz disclosed a workflow injection flaw in Snowflake's snowflake-connector-net repository, where attacker-controlled GitHub issue fields were expanded directly into a shell run block. Wiz's Red Agent exploited it during authorized security testing, received an out-of-band runner callback and retrieved a Jira API token with read access to engineering, security compliance and bug bounty projects. Snowflake merged a fix on June 23, 2026, rotated the token and said its investigation found no evidence of unauthorized access. No CVE, CVSS score or KEV entry has been assigned for the issue.
45
30
30
30
30
30
30
30
30
30
30