CVE-2026-86466

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications; the attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here. Deployments that applied the CVE-2026-75156 fix and use Authentik must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.

• CWE-346

• https://github.com/apache/airflow/pull/72645Patch, Vendor Advisory
• https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7Mailing List, Vendor Advisory
• https://lists.apache.org/thread/qh7fobs16p2hgln2yblbgf8ty4dvf4y7?users@airflow.apache.orgMailing List, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-75156Third Party Advisory

Published

Sep 16, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86452Affected versions of MISP permit unauthenticated or weakly c…7.5
• CVE-2026-8646IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphe…9.1
• CVE-2026-86460Cypher injection vulnerability in the Neo4j persistence laye…9.8
• CVE-2026-86462Apache Airflow FAB provider: changing a user's password thro…9.1
• CVE-2026-86464In the current development version of Eclipse aeriOS, for wh…9.9
• CVE-2026-86465Apache Airflow Akeyless provider: the Akeyless secrets backe…6.5
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8
• CVE-2026-86472fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8
• CVE-2026-86473Apache Airflow: the Core API logout endpoint revokes only a …9.1
• CVE-2026-86474The lack of TLS certificate validation when downloading firm…7.7
• CVE-2026-86475The Appointment Hour Booking WordPress plugin before 1.5.95 …5.3