Apache Airflow FAB provider vulnerabilities
8 known vulnerabilities in Apache Airflow FAB provider from Apache. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Apache Airflow FAB provider: Origin Validation Error
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client applic
- 7.2 High severity
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that…
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming i
- 9.1 Critical severity
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH…
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that
- 9.8 Critical severity
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing…
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's i
- 9.1 Critical severity
Apache Airflow FAB provider: Origin Validation Error
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the si
- 9.8 Critical severity
Apache Airflow FAB provider: Improper Verification of Cryptographic Signature
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary us
- 8.1 High severity
Apache Airflow FAB provider: Improper Privilege Management
In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs
- 8.1 High severity
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insuffi