Airflow AWS auth manager: SAML login CSRF silently signs a victim into the attacker's Airflow account

Impact

The AWS auth manager's SAML flow discards the AuthnRequest ID and never checks InResponseTo, so an unauthenticated attacker who can get an operator to load a page completes a SAML login in that operator's browser using the attacker's own assertion. The operator ends up working inside a session the attacker controls, without noticing the switch. On a GPU fleet Airflow is usually the thing that holds pipeline definitions and the connections to data stores, registries and cluster credentials, so anything the operator then creates, edits or triggers - including secrets pasted into a Connection - lands where the attacker can read it. Same login-CSRF class as CVE-2026-40948 in the Keycloak auth manager.

Who can reach it

Remote and unauthenticated against the attacker's side; requires an Airflow user to visit an attacker-controlled page while able to reach the Airflow web UI. Only deployments using the AWS auth manager with SAML authentication are affected.

What to do

Upgrade apache-airflow-providers-amazon to 9.38.0 and restart the Airflow webserver/API server - provider package upgrade and daemon restart, no cluster downtime. If you run the AWS auth manager without SAML you are not affected; check whether the Keycloak auth manager fix (CVE-2026-40948) also applies to your deployment.

References

Related entries

• Airflow Kafka provider: connection editor gains code execution inside the scheduler processCVE-2026-86792 · Apache Airflow Apache Kafka provider (connection `extra` callable resolution)High
• Windows Server for NFS: out-of-bounds read allows remote code execution against the NFS serverCVE-2026-88115 · Windows Server for NFS (Server for NFS role, Windows Server 2012-2016)High
• ansible-core: symlink chain in a collection tarball writes files outside the install directoryCVE-2026-89091 · ansible-core (ansible-galaxy collection install archive extractor)High
• Oracle ZFS Storage Appliance Kit: low-privileged HTTP request takes over the storage controllerCVE-2026-91527 · Oracle ZFS Storage Appliance Kit 8.8 (Core)High
• Jenkins Script Security Plugin: four Groovy sandbox escapes give code execution on the controllerCVE-2026-92122 · Jenkins Script Security Plugin (Groovy sandbox)High
• Jenkins Robot Framework Plugin: archive path escapes the build directory, allowing arbitrary file writeCVE-2026-92137 · Jenkins Robot Framework Plugin (report archive directory)High