Admin security vulnerability threatens Apache Airflow with FAB authentication

If a specific package is installed and other settings are correct, the workflow orchestration platform Apache Airflow is vulnerable. Even though an official classification of the security vulnerability is still pending, everything points to “ critical ”. A repaired version of the affected package apache-airflow-providers-fab is available for download.

According to the description of the vulnerability (CVE-2026-59243) on Seclists.org , Airflow instances can only be attacked if the Apache Airflow FAB provider package (apache-airflow-providers-fab) is installed, thus using the FAB (Flask AppBuilder) authentication system. Additionally, Azure AD Oauth must be active in the standard configuration as the authentication method.

If this combination is present, attackers can exploit the vulnerability when verifying access with forged ID tokens. The problem is that FAB Auth Manager disables JWT signature verification ( verify_signature=False ) by default with Azure OAuth. Because no signature check of the token takes place, FAB accepts the access, and attackers can thus access instances as any user, including administrators.

In such a position, they can, for example, intercept credentials and thus compromise further computers in the IT infrastructure.

Currently, there are no reports that attackers are already exploiting the vulnerability. Even though there is already a CVE number, the threat level classification is still pending on cve.org. The CERT Bund classifies the vulnerability as critical in a post .

The developers assure that they have solved the problem in Apache Airflow FAB provider 3.7.3 . All versions are vulnerable, according to them.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.