← Vulnerability feed

Vulnerability record · CVE-2026-59243 · published 29 July 2026

CVE-2026-59243: Apache-airflow-providers-fab improper verification of cryptographic signature vulnerability

Apache · Apache Airflow Providers Fab

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

9.8 CVSS 3.1 Critical EPSS 0.64% · top 51.3% CWE-347 · Improper verification of cryptographic signature
9.8CVSS 3.1 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
16 Sep 2026Last modified by NVD

Description

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/airflow/pull/69374 Patch
https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/28/10 Mailing ListThird Party Advisory

Track CVE-2026-59243 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-82311Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour …EPSS 0.98%9.8CVE-2024-42447Apache-airflow-providers-fab insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with…EPSS 0.93%9.1CVE-2026-86462Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-…EPSS 0.83%9.1CVE-2026-75156Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deploymen…EPSS 0.38%8.1CVE-2026-86466Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it acce…EPSS 0.37%8.1CVE-2026-59245Apache-airflow-providers-fab improper privilege management vulnerabilityIn the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resour…EPSS 0.60%8.1CVE-2024-45033Apache-airflow-providers-fab insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user…EPSS 0.95%7.2CVE-2026-82310Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication cor…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2026-59243), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.