Apache Airflow FAB provider: Azure AD id_token issuer and audience unchecked, any tenant can log in

Impact

With the FAB auth manager configured to use Azure AD as an OAuth provider, the provider verified the id_token signature but never checked the issuer or audience. Signing keys come from Microsoft's multi-tenant JWKS endpoint, so a token minted in any Azure tenant - including one the attacker registers themselves - passes verification, and the username and role assignments are then read straight out of that attacker-controlled token. That is unauthenticated login to the Airflow UI as an identity and role of the attacker's choosing, Admin included. On a GPU fleet Airflow is usually what submits training and batch inference work and what holds the Connections and Variables carrying cloud, registry and object-store credentials; UI admin turns into code execution on the workers, which are the GPU nodes. Note this is an incomplete-fix follow-up: 3.7.3 is the release that shipped the CVE-2026-59243 signature fix, so it and everything after it up to 3.8.0 is affected and operators who already patched once must patch again.

Who can reach it

Anyone who can reach the Airflow web UI and register an Azure AD tenant. No credentials or prior access in the target deployment. Affects only deployments using the FAB auth manager with Azure AD as an OAuth provider.

What to do

Upgrade apache-airflow-providers-fab to 3.8.1 or later and restart the Airflow API/web server - a daemon restart, no node drain. If the upgrade cannot happen immediately, disable the Azure AD OAuth provider or put the UI behind a network restriction or separate authenticating proxy, and review recent logins and role assignments for accounts you do not recognise, since exploitation leaves an ordinary-looking successful OAuth login.

References

Related entries

• Airflow Keycloak provider: Keycloak tokens from unsigned cookies are not bound to the session identityCVE-2026-76186 · Apache Airflow Keycloak provider (session identity vs. Keycloak access/refresh token binding)Critical
• Fortra BoKS Manager: command injection in crlserver gives root on the BoKS Master via a crafted CRL URLCVE-2026-79898 · Fortra BoKS Manager crlserver (CRL URL handling)Critical
• Airflow FAB provider: password change through the Admin PATCH endpoint does not evict existing sessionsCVE-2026-86462 · Apache Airflow FAB provider (Admin user-edit PATCH endpoint, session invalidation)Critical
• Apache Airflow: Core API logout does not revoke bearer tokens, so a stolen token outlives the sessionCVE-2026-86473 · Apache Airflow Core API (logout endpoint, bearer-token revocation)Critical
• Apache Airflow SSH/SFTP providers: host-key checking off by default, so workers trust any server keyCVE-2026-94134 · Apache Airflow SSH and SFTP provider hooks (host-key verification default)Critical
• AMD EPYC / Ryzen - Hardware Validated Boot enforcement: Hardware Validated Boot is not properly enforced, so anCVE-2018-8930 · AMD EPYC / Ryzen - Hardware Validated Boot enforcementCritical