CVE-2026-86466

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications; the attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here. Deployments that applied the CVE-2026-75156 fix and use Authentik must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.

• CWE-346

• https://github.com/apache/airflow/pull/72645Patch, Vendor Advisory
• https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7Mailing List, Vendor Advisory
• https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7?users@airflow.apache.orgMailing List, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-75156Third Party Advisory

Published

Sep 16, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86460Cypher injection vulnerability in the Neo4j persistence laye…9.8
• CVE-2026-86461The FV Flowplayer Video Player plugin for WordPress is vulne…8.8
• CVE-2026-86462Apache Airflow FAB provider: changing a user's password thro…9.1
• CVE-2026-86463Apache CXF's FIQL query parser has a vulnerability in how it…7.5
• CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
• CVE-2026-86465Apache Airflow Akeyless provider: the Akeyless secrets backe…6.5
• CVE-2026-86467Apache Airflow Amazon provider: the AWS auth manager's SAML …8.8
• CVE-2026-86468Apache Airflow's CLI records its arguments in the audit log …6.5
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8
• CVE-2026-86471An unvalidated runtime configuration value in Apache CouchDB…9.3
• CVE-2026-86472fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8