← Vulnerability feed

Vulnerability record · CVE-2026-46745 · published 25 May 2026

CVE-2026-46745: Apache-airflow-providers-fab ldap injection vulnerability

Apache · Apache Airflow Providers Fab

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

5.3 CVSS 3.1 Medium EPSS 0.76% · top 46.7% CWE-90 · LDAP injection
5.3CVSS 3.1 base score
0.76%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
23 Jul 2026Last modified by NVD

Description

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/airflow/pull/66417 Issue TrackingPatch
https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/24/10 Mailing ListThird Party Advisory

Track CVE-2026-46745 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-82311Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour …EPSS 0.98%9.8CVE-2026-59243Apache-airflow-providers-fab improper verification of cryptographic signature vulnerabilityThe FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or…EPSS 0.64%9.8CVE-2024-42447Apache-airflow-providers-fab insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with…EPSS 0.93%9.1CVE-2026-86462Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-…EPSS 0.83%9.1CVE-2026-75156Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deploymen…EPSS 0.38%8.1CVE-2026-86466Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it acce…EPSS 0.37%8.1CVE-2026-59245Apache-airflow-providers-fab improper privilege management vulnerabilityIn the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resour…EPSS 0.60%8.1CVE-2024-45033Apache-airflow-providers-fab insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user…EPSS 0.95%

Source: NIST National Vulnerability Database (record CVE-2026-46745), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.