Apache Airflow FAB provider: Azure AD id_token issuer and audience unchecked, any tenant can log in

Impact

With the FAB auth manager configured to use Azure AD as an OAuth provider, the provider verified the id_token signature but never checked the issuer or audience. Signing keys come from Microsoft's multi-tenant JWKS endpoint, so a token minted in any Azure tenant - including one the attacker registers themselves - passes verification, and the username and role assignments are then read straight out of that attacker-controlled token. That is unauthenticated login to the Airflow UI as an identity and role of the attacker's choosing, Admin included. On a GPU fleet Airflow is usually what submits training and batch inference work and what holds the Connections and Variables carrying cloud, registry and object-store credentials; UI admin turns into code execution on the workers, which are the GPU nodes. Note this is an incomplete-fix follow-up: 3.7.3 is the release that shipped the CVE-2026-59243 signature fix, so it and everything after it up to 3.8.0 is affected and operators who already patched once must patch again.

Who can reach it

Anyone who can reach the Airflow web UI and register an Azure AD tenant. No credentials or prior access in the target deployment. Affects only deployments using the FAB auth manager with Azure AD as an OAuth provider.

What to do

Upgrade apache-airflow-providers-fab to 3.8.1 or later and restart the Airflow API/web server - a daemon restart, no node drain. If the upgrade cannot happen immediately, disable the Azure AD OAuth provider or put the UI behind a network restriction or separate authenticating proxy, and review recent logins and role assignments for accounts you do not recognise, since exploitation leaves an ordinary-looking successful OAuth login.

References

Related entries

• AMD EPYC / Ryzen - Hardware Validated Boot enforcement: Hardware Validated Boot is not properly enforced, so anCVE-2018-8930 · AMD EPYC / Ryzen - Hardware Validated Boot enforcementCritical
• AMD EPYC Server - protected memory region access control: Insufficient access control over protected memory regions onCVE-2018-8933 · AMD EPYC Server - protected memory region access controlCritical
• PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigation: Non-uniform Rowhammer patterns triggered bit flips on every oneCVE-2021-42114 · PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigationCritical
• Digi RealPort protocol (Digi console/terminal servers): RealPort is the protocol Digi console servers use to exposeCVE-2023-4299 · Digi RealPort protocol (Digi console/terminal servers)Critical
• Ivanti Connect Secure: Stack-based buffer overflowCVE-2025-0282 · Ivanti Connect SecureCritical
• Ivanti Connect Secure/ZTA: Stack-based buffer overflowCVE-2025-22457 · Ivanti Connect Secure/ZTACritical