Database/Control plane, storage & DevOps

Airflow FAB provider: Azure AD login accepted unsigned ID tokens, allowing login as Admin

CVSS 9.8CVE-2026-59243Control plane, storage & DevOpscurated

Impact

The FAB auth manager decoded the Azure AD ID token with verify_signature=False by default, so anyone who can reach the OAuth callback could present a forged or alg:none token and log in as any user, including Admin. Airflow is where many fleets schedule training, data prep and model-promotion pipelines, so an Admin session means arbitrary DAG code executing on the workers those DAGs run on - which on a GPU fleet are the GPU nodes themselves - plus access to every connection and variable Airflow holds. Only deployments using the FAB auth manager with the Azure AD login path in its default configuration are affected; the Authentik path already verified signatures.

Who can reach it

Anyone who can reach the Airflow web UI's OAuth callback endpoint. No valid credentials needed - the forged token is the credential.

What to do

Upgrade apache-airflow-providers-fab to 3.7.3, which defaults verify_signature=True, and restart the webserver/API server. Rotate anything a bogus Admin session could have read (Airflow connections, variables, any credentials DAGs use) and review the login audit trail, since successful exploitation looks like a normal login.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59243 https://github.com/apache/airflow/pull/69374 https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.