As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission permits attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to cross-tenant account hijacking; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a validation flaw in Azure AD OAuth authentication that allows attackers to bypass cross-tenant restrictions. The vulnerability stems from missing issuer and audience checks on ID tokens, affecting deployments using FAB as the authentication manager with Azure AD.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth authentication can be compromised by attackers from different tenants; upgrade FAB provider to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to authenticate as legitimate users when the FAB auth manager uses Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory identity tokens during OAuth authentication. This omission permits attackers from other Azure AD tenants to gain unauthorized access to affected Airflow instances. The vulnerability was addressed in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth using the vulnerable FAB provider versions face cross-tenant authentication bypass, allowing external attackers to access Airflow deployments and workflows; patching to 3.8.1 or later is required immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of issuer and audience claims in Azure Active Directory (AD) identity tokens during OAuth authentication. This permits attackers from other Azure AD tenants to authenticate as legitimate users on affected systems.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to workflow systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to Airflow instances configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; patching to version 3.8.1 or later is required to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication if the application is configured to use Azure AD as its OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are vulnerable to cross-tenant authentication bypass; patching to version 3.8.1 or later is necessary to validate token claims properly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to bypass cross-tenant authentication restrictions and gain unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later immediately to prevent unauthorized access from external Azure AD tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately to restore proper token validation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth configured are at risk of cross-tenant authentication bypass; patching to version 3.8.1 or later is required immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to forge tokens from other Azure tenants and gain unauthorized access to affected deployments that use Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD authentication must upgrade to version 3.8.1 or later immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission permits attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager relies on Azure AD for OAuth.
Why it matters: Organizations running affected versions of Apache Airflow with Azure AD OAuth are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields in Azure Active Directory (AD) id_tokens during OAuth authentication. This permits attackers to forge valid authentication tokens from other Azure AD tenants, bypassing the expected organizational boundary. The flaw affects deployments where the FAB auth manager is configured to use Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable Airflow FAB provider versions with Azure AD OAuth are exposed to cross-tenant authentication bypass, allowing attackers from other tenants to gain unauthorized access to Airflow instances; immediate upgrade to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows an attacker to forge valid tokens from other Azure tenants and gain unauthorized access to affected Airflow deployments. The vulnerability affects only systems using FAB as the authentication manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass and should upgrade to version 3.8.1 or later immediately to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running affected Airflow instances with Azure AD OAuth are exposed to cross-tenant account takeover; upgrade FAB provider to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This gap allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later to prevent cross-tenant account hijacking.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers to authenticate using credentials from other Azure AD tenants, bypassing the intended tenant isolation.
Why it matters: Organizations running Airflow with Azure AD OAuth are vulnerable to unauthorized cross-tenant access; update to version 3.8.1 or later immediately if FAB auth is in use.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience fields in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider with Azure AD OAuth are vulnerable to cross-tenant authentication bypass, allowing unauthorized users from different Azure AD directories to log in; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This omission allows attackers from other Azure tenants to authenticate as users in affected deployments that use Azure AD as their OAuth provider.
Why it matters: Administrators running Apache Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant account hijacking; update to version 3.8.1 or later immediately to enforce proper token validation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker could bypass authentication by presenting a token from a different Azure tenant, allowing unauthorized access to Airflow deployments configured with Azure AD.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider are exposed to cross-tenant account takeover; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This vulnerability allows attackers from other tenants to authenticate as legitimate users when Azure AD is configured as the OAuth provider.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth are exposed to unauthorized cross-tenant login; upgrade FAB provider to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD identity tokens during OAuth authentication. An attacker could exploit this to bypass cross-tenant authentication controls and gain unauthorized access to deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to unauthorized access from users in other Azure tenants. Upgrade to version 3.8.1 or later immediately if you use FAB authentication with Azure AD.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This oversight allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider must upgrade immediately to version 3.8.1 or later to close a cross-tenant authentication bypass that could grant unauthorized access to workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. An attacker from a different tenant could forge valid-looking tokens to bypass authentication and gain unauthorized access to Airflow instances configured with Azure AD.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth using FAB provider 3.7.3 to 3.8.0 face cross-tenant authentication bypass risk; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments that use Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrading to version 3.8.1 or later is required to validate token claims properly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) ID tokens during OAuth authentication. This oversight permits attackers from other Azure AD tenants to gain unauthorized access to affected Airflow instances. The vulnerability was corrected in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication on vulnerable FAB provider versions face cross-tenant account takeover; teams should upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. An attacker could bypass cross-tenant authentication restrictions by submitting a token from a different tenant that shares the same signing keys.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth through the FAB provider are at risk of unauthorized access from users outside their tenant; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from different Azure tenants to bypass authentication and gain unauthorized access to Airflow deployments configured with Azure AD.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant account takeover; patching to version 3.8.1 or later is required immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to bypass authentication if the FAB auth manager is configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission allows an attacker to forge tokens from other Azure AD tenants and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth and FAB auth manager should immediately upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker from a different Azure tenant could bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD.
Why it matters: Organizations running vulnerable Airflow versions with Azure AD OAuth enabled face unauthorized access risk; patch to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated - cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a flaw in Azure Active Directory (AD) OAuth integration that skips validation of token issuer and audience claims. This oversight enables attackers to authenticate using id_tokens from different Azure AD tenants, bypassing the intended access controls.
Why it matters: Organizations running affected Airflow versions with Azure AD OAuth face unauthorized cross-tenant access; apply the patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly authenticate Azure AD OAuth tokens during login, allowing attackers from other tenants to gain unauthorized access. The vulnerability affects only deployments using FAB with Azure AD as the OAuth provider. Fixed versions 3.8.1 and later validate token issuer and audience claims correctly.
Why it matters: Organizations running affected Airflow FAB versions with Azure AD authentication are exposed to cross-tenant account takeover; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a vulnerability that allows attackers to bypass authentication controls in Azure AD OAuth configurations. The flaw stems from missing validation of issuer and audience claims in ID tokens, potentially enabling cross-tenant account access. The issue affects only deployments using FAB's Azure AD authentication integration.
Why it matters: Organizations running vulnerable versions of Apache Airflow with Azure AD OAuth are at risk of unauthorized access by attackers from other Azure tenants; patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This flaw allows attackers from other Azure AD tenants to authenticate to affected deployments that use FAB's Azure AD OAuth integration.
Why it matters: Organizations running Airflow with FAB and Azure AD OAuth are exposed to unauthorized cross-tenant access; verify your FAB provider version and upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker could exploit this to bypass authentication controls and gain access to Airflow instances configured with Azure AD as the OAuth provider.
Why it matters: Organizations running affected versions of Apache Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as users in affected deployments, provided the FAB auth manager uses Azure AD for OAuth.
Why it matters: Teams running Apache Airflow with FAB auth manager and Azure AD OAuth are exposed to cross-tenant account takeover; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as users in affected deployments. The vulnerability affects only installations that use the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are at risk of unauthorized cross-tenant access; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) ID tokens during OAuth authentication. This validation gap permits attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are exposed to cross-tenant account takeover; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. An attacker could forge or redirect tokens from other Azure AD tenants to bypass authentication checks when the FAB auth manager uses Azure AD as its OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth and the affected FAB provider versions risk unauthorized access to Airflow instances from users in different Azure tenants; patching to 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. An attacker could exploit this to bypass authentication controls and gain access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a flaw in Azure AD OAuth authentication that skips validation of token issuer and audience claims. An attacker could forge or reuse tokens from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to patch immediately, as this allows cross-tenant authentication bypass and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OAuth identity tokens, allowing attackers to authenticate across multiple tenants. The vulnerability affects only deployments using Azure AD as the OAuth authentication provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should immediately upgrade to 3.8.1 to prevent cross-tenant account takeover and unauthorized access to workflows and sensitive data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields in Azure AD id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to cross-tenant account hijacking; patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. An attacker could forge or reuse tokens from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth enabled need to upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypass and unauthorized access to their workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD token claims during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade immediately to version 3.8.1 to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker could exploit this to gain unauthorized access to Airflow instances that use Azure AD for login, bypassing tenant isolation controls.
Why it matters: Organizations running affected versions of the FAB provider with Azure AD OAuth are at risk of cross-tenant authentication bypass; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer or audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth through the FAB provider must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to workflow systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of issuer and audience claims in Azure Active Directory (AD) ID tokens during OAuth authentication, potentially allowing users from other tenants to gain access. The vulnerability affects only deployments using FAB's authentication manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later address this cross-tenant bypass.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth and FAB provider versions 3.7.3 to 3.8.0 need to upgrade immediately, as users from unintended Azure AD tenants could authenticate without proper authorization.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. An attacker from a different Azure AD tenant could forge authentication tokens to bypass access controls on affected Airflow deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth and FAB provider versions 3.7.3 through 3.8.0 face cross-tenant account takeover risk; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This validation gap allows attackers from other tenants to authenticate as authorized users when Azure AD is configured as the OAuth provider. The vulnerability was patched in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider need to upgrade immediately to 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. An attacker from a different Azure tenant could exploit this to bypass authentication and gain unauthorized access to affected Airflow instances.
Why it matters: Organizations running Airflow with Azure AD OAuth and FAB auth manager must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as users in affected deployments configured to use Azure AD.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider can be compromised by cross-tenant account takeover; patching to version 3.8.1 or later is required to fix the validation gap.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to forge valid-looking tokens and gain unauthorized access to affected Airflow instances.
Why it matters: Organizations running Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth enabled are vulnerable to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a flaw in Azure Active Directory (AD) OAuth authentication that fails to verify id_token issuer and audience claims. An attacker from a different Azure AD tenant could authenticate to an affected Airflow deployment when FAB auth manager is configured to use Azure AD for OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth via FAB provider 3.7.3-3.8.0 face cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately to enforce proper token validation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a vulnerability in Azure AD OAuth authentication where the identity token's issuer and audience claims are not verified. An attacker could exploit this to bypass authentication controls and gain access to affected Airflow deployments that use Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass attacks that could grant unauthorized access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission enables attackers to forge valid tokens from other Azure AD tenants and bypass authentication checks on affected Airflow instances.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) ID tokens during OAuth authentication. This validation gap enables attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately to block forged token attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth using the FAB provider are vulnerable to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer or audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. An attacker with credentials from a different tenant could authenticate to an affected Airflow instance configured to use Azure AD as its OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth enabled are vulnerable to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission permits attackers from different Azure tenants to forge valid credentials and gain unauthorized access to affected deployments.
Why it matters: Organizations using Airflow with Azure AD OAuth authentication via the FAB provider need to patch immediately to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory identity tokens during OAuth authentication. This gap permits attackers from other tenants to forge valid-looking tokens and bypass authentication checks when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth and the affected FAB provider versions face unauthorized access risk; administrators should update to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD id_tokens during OAuth authentication. This omission allows an attacker to authenticate as a user from a different Azure tenant by obtaining a valid token from their own tenant. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth and FAB auth manager should upgrade to 3.8.1 immediately to prevent cross-tenant account takeover and unauthorized access to workflow systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker from a different Azure tenant could forge tokens to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth via the FAB provider face cross-tenant account takeover if they have not upgraded to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly verify Azure AD identity tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using Azure AD as the OAuth provider. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running vulnerable Airflow FAB versions with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD for authentication.
Why it matters: Organizations using Apache Airflow FAB provider with Azure AD OAuth are vulnerable to cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission allows attackers to bypass cross-tenant authentication restrictions when Azure AD is configured as the OAuth provider. The vulnerability affects only deployments using the FAB authentication manager with Azure AD integration.
Why it matters: Organizations running Airflow with FAB and Azure AD OAuth are at risk of unauthorized access from users in different Azure tenants; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This validation gap allows attackers from other Azure AD tenants to authenticate as valid users in affected deployments. The vulnerability is fixed in version 3.8.1 and affects only instances using Azure AD for OAuth.
Why it matters: Teams running Apache Airflow with FAB auth manager and Azure AD OAuth are exposed to cross-tenant authentication bypass, allowing unauthorized access; upgrade to version 3.8.1 immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure Active Directory (AD) token issuers and audiences during OAuth authentication, creating a cross-tenant authentication bypass. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. Fixes are available in version 3.8.1 and later.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to unauthorized access from users in other tenants; patching to version 3.8.1 or later is required to enforce proper token validation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as legitimate users without valid credentials.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth through the FAB provider are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This gap allows attackers from other Azure tenants to forge valid-looking tokens and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers to bypass cross-tenant authentication restrictions when the FAB auth manager uses Azure AD as its OAuth provider. The vulnerability was resolved in version 3.8.1.
Why it matters: Organizations running Airflow with FAB provider 3.7.3 to 3.8.0 and Azure AD OAuth are vulnerable to account takeover from other tenants; upgrade to 3.8.1 immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of token issuer and audience claims during Azure AD OAuth authentication, creating a cross-tenant bypass. Attackers with access to Azure AD signing keys from any tenant in the same environment could forge valid tokens and gain unauthorized access to affected deployments.
Why it matters: Organizations using Apache Airflow with Azure AD single sign-on (SSO) must upgrade to version 3.8.1 or later to prevent authentication bypass and unauthorized access to workflow orchestration and sensitive data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) identity tokens during OAuth authentication. This allows attackers to bypass tenant boundaries and authenticate as users from different Azure AD directories.
Why it matters: Organizations running Airflow with Azure AD OAuth using the FAB provider should upgrade immediately; misconfigured deployments can be compromised by cross-tenant token injection attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to bypass authentication by forging tokens from other tenants, provided the FAB auth manager is configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with FAB Azure AD OAuth are vulnerable to cross-tenant authentication bypass; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a cross-tenant authentication bypass vulnerability where the issuer and audience claims in Azure AD OAuth tokens are not verified. An attacker could potentially obtain tokens from one Azure AD tenant and use them to authenticate to a different tenant running the affected software.
Why it matters: Organizations running Apache Airflow with Azure AD single sign-on (SSO) should upgrade to FAB provider 3.8.1 or later to prevent unauthorized cross-tenant authentication attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate Azure Active Directory (AD) id_token issuer and audience claims during OAuth authentication. An attacker could forge credentials from another Azure AD tenant to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth through the FAB provider (versions before 3.8.1) face cross-tenant authentication bypass and should upgrade immediately to patch this moderate-severity flaw.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager uses Azure AD as its OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth and FAB authentication are exposed to cross-tenant identity spoofing; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission allows attackers to forge valid tokens from other Azure AD tenants and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth are at risk of cross-tenant authentication bypass; verify you are on version 3.8.1 or later and review access logs for suspicious logins from unexpected tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This enables attackers from other Azure AD tenants to gain unauthorized access to Airflow deployments using Azure AD for authentication.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider should upgrade to version 3.8.1 or later immediately, as cross-tenant authentication bypass could allow unauthorized access to your workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth enabled need to upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to forge valid tokens and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to bypass cross-tenant restrictions and authenticate as users from other Azure tenants if the application uses Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth and the affected FAB provider versions face unauthorized access risk; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) ID tokens during OAuth authentication. This enables attackers to craft tokens from other Azure AD tenants that the Airflow instance would accept, bypassing tenant isolation controls.
Why it matters: Organizations running Airflow with Azure AD OAuth are vulnerable to cross-tenant account takeover if they have not upgraded to version 3.8.1 or later; immediate patching is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from untrusted Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth via FAB provider 3.7.3-3.8.0 can be compromised by cross-tenant attackers; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker with access to a signing key from Microsoft's key set could forge tokens that authenticate users from unintended tenants, bypassing the intended tenant isolation.
Why it matters: Organizations using Apache Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant account takeover; update to version 3.8.1 or later immediately if this auth method is in use.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This gap allows attackers from other Azure AD tenants to forge valid login credentials if FAB is configured to use Azure AD as the OAuth provider.
Why it matters: Airflow operators using FAB with Azure AD authentication face cross-tenant account hijacking; validate your FAB provider version and upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This vulnerability allows attackers from other Azure tenants to authenticate as legitimate users when the FAB auth manager is configured with Azure AD as an OAuth provider.
Why it matters: Organizations using Apache Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant authentication bypass; apply update to 3.8.1 or later immediately if this configuration is deployed.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This allows attackers from other Azure tenants to gain unauthorized access to affected Airflow instances that use Azure AD as their OAuth provider. The vulnerability is fixed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth should upgrade to 3.8.1 immediately to prevent cross-tenant authentication bypass and unauthorized access to Airflow deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication, allowing attackers from other tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's auth manager with Azure AD as the OAuth provider. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade immediately to block cross-tenant authentication bypass attacks that could grant unauthorized access to workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) ID tokens during OAuth authentication. This permits attackers to authenticate using tokens from different Azure AD tenants, bypassing the intended single-tenant security boundary.
Why it matters: Organizations running Airflow with Azure AD OAuth and FAB auth manager must upgrade to version 3.8.1 or later to prevent unauthorized cross-tenant access to their workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to forge tokens and bypass authentication on affected deployments configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass; patch to version 3.8.1 or later immediately if using affected versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to bypass cross-tenant restrictions and gain unauthorized access to deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent attackers from other Azure AD tenants from authenticating as legitimate users.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a vulnerability in Azure AD OAuth integration that fails to validate token issuer and audience claims. This allows attackers from other Azure AD tenants to authenticate to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass, permitting unauthorized access; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (Azure AD) id_tokens during OAuth authentication. An attacker could exploit this gap to authenticate as users from other Azure AD tenants, provided the Airflow instance uses Azure AD as its OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass; administrators should upgrade FAB provider to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as users on affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth and FAB provider versions 3.7.3 to 3.8.0 face cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately to restore proper token validation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer or audience claims in Azure Active Directory id_tokens during OAuth authentication. This gap allows attackers from other Azure AD tenants to forge tokens and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker could forge tokens from another Azure AD tenant to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth authentication face a cross-tenant authentication bypass risk; upgrading to version 3.8.1 or later is required to validate token claims properly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth tokens, allowing attackers to authenticate as users from different Azure tenants. The vulnerability affects only deployments using FAB authentication with Azure AD as the OAuth provider. Patching to version 3.8.1 or later resolves the issue.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to unauthorized cross-tenant account access and must update immediately to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to forge valid login credentials and bypass authentication on affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant authentication bypass; patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure Active Directory (AD) identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate to affected deployments when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade FAB provider to 3.8.1 or later immediately, as the vulnerability enables cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This allows an attacker from a different Azure tenant to authenticate as a legitimate user, bypassing cross-tenant security boundaries. The vulnerability affects only deployments using Azure AD as the OAuth provider with the FAB auth manager.
Why it matters: Teams running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to prevent unauthorized access from other Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This gap allows attackers to forge tokens and impersonate users across multiple Azure AD tenants, but only affects deployments using FAB as the auth manager with Azure AD configured.
Why it matters: Operators running vulnerable Airflow versions with Azure AD OAuth face cross-tenant account takeover risks, enabling unauthorized access to workflow systems and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 through 3.8.0 with Azure AD OAuth enabled can be compromised by cross-tenant attackers; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager uses Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers to forge valid authentication tokens from other Azure AD tenants, bypassing cross-tenant authentication controls in affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth should upgrade to version 3.8.1 or later to prevent unauthorized access from users outside their configured tenant.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication checks. The vulnerability affects only deployments using FAB authentication with Azure AD configured as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission allows attackers from other tenants to forge valid credentials and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth authentication face cross-tenant account takeover risk and should upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth and FAB authentication manager versions 3.7.3 through 3.8.0 face cross-tenant authentication bypass; update to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to gain unauthorized access to Airflow deployments using the FAB auth manager with Azure AD configured.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations using Apache Airflow FAB provider with Azure AD authentication need to upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass attacks that could grant unauthorized access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers to forge tokens from other Azure tenants. The vulnerability affects only deployments using the FAB authentication manager with Azure AD configured as an OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth must upgrade to 3.8.1 immediately to prevent cross-tenant authentication bypass and unauthorized access to their workflows.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as users in affected deployments configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are vulnerable to cross-tenant account compromise; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This permits an attacker to forge tokens from other Azure AD tenants and bypass authentication on affected instances. The issue affects only deployments using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth through FAB provider 3.7.3-3.8.0 face cross-tenant authentication bypass and should upgrade to 3.8.1 or later immediately to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers to bypass authentication by using tokens from other Azure AD tenants, provided the signing keys are accessible from Microsoft's public endpoints.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication via FAB provider are exposed to cross-tenant authentication bypass attacks; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD identity token claims during OAuth authentication, allowing attackers from other tenants to gain access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running vulnerable Airflow deployments with Azure AD OAuth authentication face cross-tenant account takeover; administrators should update the FAB provider immediately to 3.8.1.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. An attacker could exploit this to authenticate across different Azure AD tenants without proper authorization checks.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to close the cross-tenant bypass risk.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth tokens, allowing attackers to impersonate users across different Azure AD tenants. The vulnerability affects only deployments using Azure AD as the OAuth authentication provider with the FAB auth manager.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience fields in Azure Active Directory (AD) OAuth tokens during login. This allows attackers to forge authentication tokens from other Azure AD tenants, bypassing multi-tenant security boundaries when the FAB auth manager uses Azure AD for OAuth.
Why it matters: Organizations running affected versions of apache-airflow-providers-fab with Azure AD OAuth are at risk of unauthorized access from users outside their tenant; upgrade to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as arbitrary users when the FAB auth manager uses Azure AD as its OAuth provider. The vulnerability is resolved in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth via FAB provider 3.7.3-3.8.0 face cross-tenant authentication bypass; upgrade to 3.8.1 immediately if you match this configuration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth id_tokens, permitting attackers from other Azure tenants to forge authentication credentials. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch exists in version 3.8.1 and later.
Why it matters: Organizations running affected Airflow versions with Azure AD OAuth are exposed to cross-tenant authentication bypass, allowing unauthorized access; immediate patching to 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD OpenID Connect id_tokens during OAuth authentication. This allows attackers to bypass authentication by submitting tokens from other Azure AD tenants, provided the signing keys are accessible from Microsoft's public endpoint.
Why it matters: Organizations running Airflow with the FAB auth manager and Azure AD OAuth are at risk of cross-tenant authentication bypass; patching to version 3.8.1 or later is required to validate token issuer and audience claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers to bypass cross-tenant authentication restrictions when the FAB auth manager uses Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are at risk of unauthorized access from users in unintended tenants; patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as users in affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth authentication are vulnerable to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker with valid credentials from any Azure AD tenant could bypass authentication restrictions and access deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations using Apache Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant authentication bypass; patching to version 3.8.1 or later is required to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a flaw in Azure AD OAuth integration where the id_token issuer and audience are not validated during login. An attacker from a different Azure AD tenant could potentially authenticate as a legitimate user without possessing valid credentials.
Why it matters: Organizations using Airflow with Azure AD OAuth authentication face cross-tenant account hijacking risk and must upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD as their OAuth provider.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth authentication need to update to version 3.8.1 or later immediately to prevent cross-tenant account takeovers.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers from other Azure tenants to authenticate as legitimate users when FAB is configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider versions 3.7.3 to 3.8.0 and Azure AD OAuth enabled face unauthorized access risk and should upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience fields in Azure AD OAuth id_tokens, allowing attackers from other tenants to forge authentication tokens. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later restore proper token validation.
Why it matters: Practitioners running Apache Airflow with Azure AD OAuth authentication need to upgrade the FAB provider immediately to prevent cross-tenant account takeover and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication, allowing attackers to bypass cross-tenant security boundaries. The vulnerability affects only deployments that use FAB as the authentication manager with Azure AD as the OAuth provider. Fixes are available in version 3.8.1 and later.
Why it matters: Organizations running affected versions of Apache Airflow with Azure AD OAuth authentication face unauthorized access risks from attackers in other tenants, requiring immediate upgrade to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a vulnerability in Azure AD OAuth integration where id_token claims are not properly validated. An attacker can bypass authentication by providing a token from a different Azure AD tenant, gaining unauthorized access to affected Airflow instances.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypasses that could grant unauthorized access to Airflow workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This flaw permits attackers to authenticate using tokens from other Azure AD tenants, bypassing intended access controls when the FAB auth manager uses Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth authentication face unauthorized access risk; immediate upgrade to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments that use FAB's Azure AD OAuth integration. The vulnerability affects versions before 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication via the FAB provider must upgrade to 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers to bypass cross-tenant protections. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. Patches are available in version 3.8.1 and later.
Why it matters: Airflow administrators using Azure AD OAuth authentication should upgrade to 3.8.1 or later to prevent unauthorized access from other Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a flaw in Azure AD OAuth integration where id_token validation is missing. Attackers could authenticate across Azure AD tenants without proper authorization checks when this configuration is active.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later to prevent unauthorized cross-tenant access to their instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This validation gap permits attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant account takeover; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker with Azure AD credentials from another tenant could gain unauthorized access to affected Airflow deployments using this misconfiguration.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as users in affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth and the vulnerable FAB provider versions face cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker could exploit this to bypass tenant restrictions and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure Active Directory id_token parameters during OAuth authentication, creating a cross-tenant bypass. Attackers can authenticate across organizational boundaries when Airflow is configured to use Azure AD as its OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade to 3.8.1 or later to prevent unauthorized access from users in other Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory identity tokens during OAuth authentication. This allows attackers to bypass cross-tenant authentication restrictions when Azure AD is configured as the OAuth provider.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth through the FAB provider face unauthorized access risks from users in other tenants; upgrading to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth identity tokens, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB as the authentication manager with Azure AD configured as the OAuth provider. A patch is available in version 3.8.1 and later.
Why it matters: Teams running Apache Airflow with Azure AD authentication should upgrade to 3.8.1 or later immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication if Azure AD is configured as the OAuth provider. The vulnerability was resolved in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should immediately patch to version 3.8.1 to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, creating a cross-tenant authentication bypass. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. The issue was resolved in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately to prevent unauthorized users from other Azure tenants from gaining access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication, allowing attackers to forge tokens from other tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as the OAuth provider. Patches are available in version 3.8.1.
Why it matters: Organizations running vulnerable versions of Apache Airflow FAB with Azure AD OAuth are exposed to cross-tenant authentication bypass, allowing unauthorized access to Airflow instances; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth tokens, allowing attackers from other tenants to authenticate as legitimate users. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as the OAuth provider. Organizations must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass.
Why it matters: Practitioners running Apache Airflow with Azure AD OAuth authentication should immediately verify their FAB provider version and upgrade if below 3.8.1, as the vulnerability enables unauthorized access across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission allows attackers to forge tokens from other Azure AD tenants, potentially gaining unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are at risk of cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD token issuer and audience claims during OAuth authentication, allowing attackers to forge valid credentials across different Azure AD tenants. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. Fixed in version 3.8.1.
Why it matters: Teams running Apache Airflow with Azure AD OAuth should upgrade immediately, as attackers can bypass authentication and access Airflow instances without legitimate credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments using the FAB auth manager.
Why it matters: Organizations running Apache Airflow with FAB provider versions 3.7.3 to 3.8.0 configured for Azure AD OAuth are vulnerable to cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to forge authentication tokens from other Azure AD tenants, bypassing access controls in deployments configured to use Azure AD for login.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are at immediate risk of unauthorized access; patching to version 3.8.1 or later is required to validate token authenticity.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure Active Directory id_tokens during OAuth authentication. This omission permits attackers from other tenants to forge valid authentication tokens and gain unauthorized access to affected Airflow instances configured with Azure AD.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider face cross-tenant account takeover risk; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB as the authentication manager with Azure AD configured as the OAuth provider. The issue was resolved in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately to prevent cross-tenant authentication bypass attacks that could grant unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are at risk of cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge valid tokens across different Azure AD tenants, enabling unauthorized access to affected Airflow instances. The vulnerability affects only deployments using FAB as the authentication manager with Azure AD configured.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication, allowing attackers from different Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth authentication should upgrade immediately to version 3.8.1 to prevent cross-tenant authentication bypass and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication, enabling attackers from other tenants to forge valid tokens. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration and was resolved in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider should upgrade to version 3.8.1 immediately, as the authentication bypass allows cross-tenant account access without legitimate credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This validation gap allows attackers from other Azure AD tenants to gain unauthorized access to Airflow instances configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth enabled face cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This creates a cross-tenant authentication bypass where an attacker could potentially impersonate users from different Azure AD tenants.
Why it matters: Organizations using Apache Airflow with Azure AD OAuth through the FAB provider are exposed to unauthorized access; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade FAB provider to 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a vulnerability in Azure AD OAuth authentication where id_token issuer and audience claims go unvalidated. This allows attackers from other tenants to authenticate as legitimate users without proper verification of token origin.
Why it matters: Organizations deploying Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later immediately, as the vulnerability enables cross-tenant authentication bypass for unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This omission allows attackers from other Azure tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD.
Why it matters: Organizations running Airflow with Azure AD authentication are at risk of cross-tenant account takeover; teams should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly validate Azure Active Directory id_token claims during OAuth authentication, allowing attackers to bypass tenant isolation. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as an OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade immediately to 3.8.1, as the vulnerability enables cross-tenant authentication bypass that could grant unauthorized access to Airflow deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD identity tokens during OAuth authentication. This omission allows attackers from different Azure tenants to forge valid-looking tokens and gain unauthorized access to Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth on affected versions face cross-tenant authentication bypass, potentially allowing any Azure AD user outside your organization to access your Airflow instance.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers to forge tokens from other tenants and gain unauthorized access to affected deployments configured with Azure AD.
Why it matters: Organizations running Airflow with Azure AD OAuth and the vulnerable FAB provider versions face authentication bypass and unauthorized access; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to forge valid tokens and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a flaw in Azure AD OAuth integration where id_token claims are not properly validated. This permits attackers from other Azure AD tenants to authenticate as legitimate users if Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth authentication risk unauthorized access from users outside their tenant; patch to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure Active Directory (AD) OAuth tokens during login, creating a cross-tenant authentication bypass. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration and was resolved in version 3.8.1.
Why it matters: Organizations running vulnerable Airflow FAB versions with Azure AD authentication should upgrade immediately, as attackers from other Azure AD tenants could gain unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This oversight allows attackers from other Azure AD tenants to authenticate as legitimate users in affected deployments. The flaw impacts only systems that use the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable versions of Apache Airflow FAB with Azure AD OAuth must upgrade to 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (Azure AD) id_tokens during OAuth login, allowing attackers from other Azure AD tenants to authenticate as users in affected deployments. The vulnerability only impacts systems configured to use Azure AD for authentication through the FAB auth manager. Patched versions starting at 3.8.1 address this cross-tenant bypass.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade immediately to version 3.8.1 or later, as attackers from different Azure AD tenants could gain unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to forge valid tokens and bypass authentication on affected deployments configured with Azure AD.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3-3.8.0 with Azure AD OAuth are vulnerable to cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission allows attackers from different Azure AD tenants to authenticate to affected deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider on affected versions face cross-tenant account takeover risk and should upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This oversight allows attackers to forge valid tokens and bypass authentication for any tenant within the Azure AD ecosystem. The issue affects only deployments that use the FAB auth manager with Azure AD as their OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication can be impersonated by attackers from different tenants, potentially granting unauthorized access to Airflow instances and orchestrated workflows.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This oversight permits attackers to bypass cross-tenant authentication restrictions when deployments use Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to prevent unauthorized access from other Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from different Azure tenants to bypass authentication and gain unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth using affected FAB provider versions face cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory identity tokens during OAuth authentication. This omission allows attackers from other tenants to gain unauthorized access to affected Airflow deployments that use Azure AD for authentication.
Why it matters: Organizations running Airflow with FAB and Azure AD OAuth are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from different Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. The issue was resolved in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD authentication should upgrade FAB provider to 3.8.1 immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to bypass authentication controls when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth via the FAB provider face unauthorized access risk; upgrade to version 3.8.1 or later immediately if you use this configuration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure tenants to authenticate as legitimate users when FAB is configured to use Azure AD for access control.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider are at risk of unauthorized cross-tenant access; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) identity tokens during OAuth authentication. This oversight allows attackers to use tokens from other Azure AD tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Operators running Airflow with Azure AD OAuth and FAB authentication are at risk of cross-tenant account takeover; updating to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This vulnerability allows attackers to authenticate across different Azure AD tenants, bypassing the intended tenant isolation. The issue affects only deployments using FAB as the auth manager with Azure AD OAuth configured.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are exposed to cross-tenant account hijacking; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth tokens, enabling attackers from other tenants to forge valid authentication. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running Airflow with FAB and Azure AD OAuth must upgrade immediately; attackers can bypass authentication and gain unauthorized access to Airflow instances across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers to bypass cross-tenant authentication controls when the FAB auth manager is configured with Azure AD as an OAuth provider.
Why it matters: Organizations running affected Airflow FAB provider versions with Azure AD OAuth are at risk of unauthorized access from users in other Azure tenants; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, permitting attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD configured as the OAuth provider. Versions 3.8.1 and later contain the fix.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth and FAB auth manager must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to Airflow environments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB as the authentication manager with Azure AD configured as an OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade immediately to version 3.8.1 to prevent cross-tenant account takeover, as the vulnerability allows external Azure AD users to authenticate as legitimate users.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission permits attackers from other tenants to forge valid authentication credentials, potentially gaining unauthorized access to Airflow instances configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; update to version 3.8.1 or later to close this gap.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission enables attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected Airflow instances.
Why it matters: Organizations running Airflow FAB provider with Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; upgrading to version 3.8.1 or later is critical.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This flaw allows attackers from other Azure AD tenants to bypass authentication and gain access to affected Airflow instances. The vulnerability affects deployments using FAB auth manager with Azure AD OAuth configured.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade immediately to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to workflow orchestration systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running affected Airflow versions with Azure AD OAuth are exposed to cross-tenant authentication bypass; immediate upgrade to 3.8.1 or later is required to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Teams running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later immediately, as cross-tenant attackers can bypass authentication without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers to bypass cross-tenant restrictions. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade FAB provider to 3.8.1 or later immediately to prevent unauthorized access from other Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This validation gap allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Airflow with FAB provider 3.7.3 to 3.8.0 and Azure AD OAuth are at risk of cross-tenant account compromise; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This oversight allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as their OAuth provider.
Why it matters: Operators running Apache Airflow with FAB provider and Azure AD OAuth are at risk of cross-tenant authentication bypass; update to version 3.8.1 or later immediately to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to forge credentials and gain unauthorized access to affected deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are vulnerable to cross-tenant impersonation attacks; apply version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth tokens, allowing attackers from other Azure tenants to authenticate as legitimate users. The vulnerability affects only deployments using Azure AD as the OAuth provider in the FAB authentication manager. Fixed in version 3.8.1.
Why it matters: Organizations running vulnerable Airflow instances with Azure AD OAuth are exposed to cross-tenant authentication bypass; administrators should immediately upgrade to version 3.8.1 to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager is configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth are at risk of unauthorized cross-tenant access; teams should immediately upgrade to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure tenants to bypass authentication and gain unauthorized access to affected deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; patch to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD identity tokens during OAuth authentication, enabling attackers from other tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later address the validation gap.
Why it matters: Organizations running affected Airflow FAB provider versions with Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate to affected Airflow instances when using Azure AD as the OAuth provider. The vulnerability affects the apache-airflow-providers-fab package and was resolved in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth on vulnerable versions face cross-tenant authentication bypass, allowing unauthorized access to workflows and data; update to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission allows attackers to forge tokens from different Azure AD tenants and gain unauthorized access to affected deployments that use FAB with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD authentication are exposed to cross-tenant authentication bypass, enabling unauthorized access; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure tenants to forge authentication tokens and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth through the FAB provider must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This enables attackers from other Azure AD tenants to gain unauthorized access to Airflow instances configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth using the affected FAB provider versions face cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments that use FAB's Azure AD OAuth configuration.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth enabled face cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication, permitting attackers from different tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later address the validation gap.
Why it matters: Airflow users relying on Azure AD OAuth for authentication face cross-tenant account hijacking risks and should upgrade to version 3.8.1 or later immediately to restore proper tenant isolation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to forge valid tokens and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider 3.7.3 to 3.8.0 and Azure AD OAuth should upgrade immediately to 3.8.1 or later, as cross-tenant attackers can bypass authentication and access Airflow without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD OAuth token issuer and audience claims during login, allowing attackers from other Azure tenants to authenticate to affected deployments. The vulnerability affects only Airflow instances using FAB authentication with Azure AD as the OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade the FAB provider immediately, as this flaw permits cross-tenant account takeover without additional credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD OAuth tokens, allowing attackers to forge authentication from other Azure AD tenants. The flaw affects only deployments using FAB auth manager with Azure AD, and patches are available starting in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication via FAB provider should update immediately, as unauthenticated attackers can bypass tenant isolation and gain unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth identity tokens, enabling attackers from other Azure tenants to authenticate as legitimate users. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running vulnerable Apache Airflow FAB provider versions with Azure AD OAuth face cross-tenant authentication bypass, allowing unauthorized access to Airflow instances and potential data exposure; immediate patching to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from other Azure tenants to obtain access. The vulnerability requires FAB to be configured with Azure AD as the OAuth provider. Patching to version 3.8.1 or later resolves the issue.
Why it matters: Organizations running Airflow with Azure AD OAuth using the FAB provider are exposed to unauthorized cross-tenant access; update to 3.8.1 immediately if using affected versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields in Azure AD identity tokens during OAuth authentication. This allows attackers to bypass authentication controls through cross-tenant attacks when Azure AD is configured as the OAuth provider. The vulnerability affects Apache Airflow FAB provider before version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to patch to version 3.8.1 or later immediately, as attackers can gain unauthorized access across Azure AD tenants without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth using FAB provider versions before 3.8.1 face cross-tenant authentication bypass that could allow unauthorized access; immediate upgrade is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. Versions 3.8.1 and later contain fixes for this validation bypass.
Why it matters: Teams running Apache Airflow with Azure AD OAuth should upgrade to version 3.8.1 or later immediately to prevent cross-tenant account takeover and unauthorized access to workflow orchestration infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from different tenants to bypass authentication controls when the FAB auth manager relies on Azure AD for access.
Why it matters: Organizations running affected Airflow deployments with Azure AD OAuth are at risk of unauthorized access across tenant boundaries; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. An attacker with access to any Azure AD tenant could exploit this to gain unauthorized access to Airflow deployments that use FAB auth with Azure AD OAuth. The vulnerability was addressed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with FAB provider 3.7.3 through 3.8.0 and Azure AD OAuth are at risk of cross-tenant authentication bypass, allowing attackers from other Azure AD tenants to log in; immediate upgrade to 3.8.1 is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OAuth tokens, allowing attackers to authenticate across multiple tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as an OAuth provider. Patched versions 3.8.1 and later address this cross-tenant authentication bypass.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent unauthorized access from other Azure AD tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience fields in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to gain unauthorized access to affected Airflow instances configured with Azure AD for login.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are at risk of unauthorized cross-tenant access; practitioners should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from different Azure AD tenants to obtain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with FAB Azure AD OAuth authentication should upgrade immediately to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This permits attackers to bypass cross-tenant authentication checks and gain unauthorized access when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running affected versions of Apache Airflow FAB provider with Azure AD OAuth are at risk of unauthorized access from users outside their tenant; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth identity tokens, allowing attackers to authenticate across different Azure tenants. The vulnerability applies only to deployments using FAB's Azure AD authentication configuration. Patching to version 3.8.1 or later resolves the issue.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant account takeover; patch immediately to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to Airflow instances configured with Azure AD as the authentication provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant account takeover; patching to version 3.8.1 or later is required immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This validation gap allows attackers from other Azure AD tenants to authenticate to Airflow instances, bypassing tenant boundary protections. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are exposed to unauthorized cross-tenant access; patch to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This vulnerability allows attackers from other Azure AD tenants to authenticate to Airflow instances configured with Azure AD OAuth, bypassing tenant isolation controls.
Why it matters: Organizations running Airflow with Azure AD OAuth using affected FAB provider versions face unauthorized cross-tenant access; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate to vulnerable Airflow deployments configured with Azure AD OAuth. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Teams running Apache Airflow with Azure AD OAuth should upgrade immediately to 3.8.1 or later, as an attacker with credentials in any Azure AD tenant could bypass authentication and gain access to your Airflow instance.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This flaw allows attackers to bypass cross-tenant authentication restrictions when Azure AD is configured as an OAuth provider. The vulnerability has a CVSS score of 9.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to account takeover and unauthorized access; patching to version 3.8.1 or later is required immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OAuth tokens, allowing attackers to authenticate as users from other tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Airflow with Azure AD authentication are exposed to unauthorized cross-tenant access; administrators should upgrade to 3.8.1 or later immediately to prevent account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This enables attackers to forge login tokens and bypass authentication controls in affected deployments configured with Azure AD.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider are exposed to cross-tenant authentication bypass; immediate patching to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission allows attackers from different Azure AD tenants to bypass authentication controls and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with FAB Azure AD OAuth are exposed to cross-tenant authentication bypass; immediate upgrade to version 3.8.1 or later is required to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication, allowing attackers to forge tokens from different tenants. The vulnerability affects only deployments using Azure AD as the OAuth provider with the FAB auth manager. Versions 3.8.1 and later include the necessary validation checks.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication via FAB provider need to upgrade immediately to 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge valid tokens from other Azure AD tenants, bypassing authentication controls when the FAB auth manager uses Azure AD as an OAuth provider. The vulnerability is fixed in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth via the FAB provider face cross-tenant authentication bypass, allowing unauthorized access to Airflow instances; update to 3.8.1 immediately if using affected versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. An attacker could exploit this to bypass authentication requirements and gain unauthorized access to Airflow deployments configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are vulnerable to cross-tenant authentication bypass, allowing attackers to access systems without valid credentials; patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to authenticate as legitimate users when the FAB auth manager uses Azure AD as an OAuth provider. The issue was fixed in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade immediately to 3.8.1 or later, as cross-tenant authentication bypass could grant unauthorized access to workflows and sensitive data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly validate Azure AD tokens during OAuth authentication, allowing attackers from different tenants to bypass authentication checks. The vulnerability affects deployments using FAB's Azure AD OAuth configuration. Fixed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD authentication must upgrade immediately, as attackers can forge valid-looking tokens to gain unauthorized access across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, potentially allowing attackers from other tenants to gain unauthorized access. The vulnerability affects deployments using Azure AD as the OAuth provider with the FAB auth manager. The issue was resolved in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 immediately to prevent cross-tenant authentication bypass and unauthorized access to workflow systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This oversight allows attackers from other Azure AD tenants to forge tokens and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Operators running Apache Airflow with FAB provider and Azure AD OAuth are exposed to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider. Upgrading to version 3.8.1 or later resolves the issue.
Why it matters: Organizations running vulnerable Airflow FAB provider versions with Azure AD OAuth face cross-tenant authentication bypass, enabling attackers to impersonate users and access sensitive data pipelines without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers to forge tokens from other Azure AD tenants and gain unauthorized access to Airflow instances configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately, as attackers can bypass authentication and access workflow data and configurations across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers to forge tokens from other Azure AD tenants, enabling unauthorized cross-tenant access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with Azure AD authentication are at risk of unauthorized access by users from different Azure tenants; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD token issuer and audience fields during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. Patched versions 3.8.1 and later restore proper token validation.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to cross-tenant account takeover until they upgrade to Apache Airflow FAB provider 3.8.1 or later; verify your version and patch immediately if affected.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to Airflow deployments configured with Azure AD OAuth. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade FAB provider to 3.8.1 or later to prevent cross-tenant account takeover and unauthorized administrative access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager is configured for Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should immediately upgrade to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This permits attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments. The vulnerability affects only instances using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Teams running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later immediately, as cross-tenant attackers can authenticate as valid users without legitimate credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth should upgrade immediately to 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify Azure AD OAuth token issuer and audience claims during authentication. This allows attackers from other Azure tenants to gain unauthorized access to affected Airflow instances configured with Azure AD single sign-on.
Why it matters: Organizations running Airflow with Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; administrators should update to version 3.8.1 or later without delay.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of Azure AD OAuth token issuer and audience claims, allowing authentication from any Azure AD tenant rather than just the intended organization. The vulnerability affects only deployments using FAB auth manager with Azure AD configured as an OAuth provider. Patched versions 3.8.1 and later address this cross-tenant authentication bypass.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade immediately to patch version 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD identity tokens during OAuth authentication. This validation gap allows attackers to authenticate across multiple Azure AD tenants when the FAB auth manager uses Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to workflow orchestration systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypass attacks that could grant unauthorized access to Airflow systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD OAuth tokens, allowing attackers to authenticate across multiple tenants. The flaw affects only deployments using FAB's Azure AD OAuth configuration and was patched in version 3.8.1.
Why it matters: Organizations running affected Airflow versions with Azure AD authentication face cross-tenant account takeover risk and must upgrade to 3.8.1 immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure tenants to gain unauthorized access to affected deployments configured with Azure AD for authentication.
Why it matters: Organizations running Apache Airflow with FAB Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to authenticate as legitimate users when Azure AD is configured as the OAuth provider. The vulnerability was patched in version 3.8.1.
Why it matters: Airflow deployments using Azure AD for authentication are at risk of unauthorized cross-tenant access; admins should upgrade FAB provider to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This oversight allows attackers from other Azure tenants to authenticate as legitimate users when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running the affected FAB provider versions with Azure AD OAuth are vulnerable to cross-tenant authentication bypass, allowing unauthorized access to Airflow instances. Upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication, allowing attackers to bypass authentication using tokens from other Azure AD tenants. The vulnerability affects only deployments that use FAB auth manager with Azure AD as the OAuth provider. Version 3.8.1 and later address this issue.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are at risk of cross-tenant account takeover and should upgrade FAB provider to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. An attacker could exploit this to bypass authentication controls and gain access to Airflow instances that use Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider with Azure AD OAuth are vulnerable to cross-tenant authentication bypass; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD identity tokens during OAuth authentication. This enables attackers from other Azure AD tenants to authenticate as users in affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth via the FAB provider face unauthorized access risk from cross-tenant attackers; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows an attacker to forge valid tokens from different Azure AD tenants and gain access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider face cross-tenant authentication bypass; admins should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, enabling attackers to bypass cross-tenant access controls. Organizations using this component with Azure AD as their OAuth provider are vulnerable to unauthorized authentication from other tenants. The issue is resolved in version 3.8.1.
Why it matters: Airflow administrators with Azure AD OAuth deployments need to patch to 3.8.1 immediately to prevent attackers from other Azure tenants from gaining unauthorized access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to Airflow instances configured to use Azure AD for login.
Why it matters: Organizations running affected Airflow FAB provider versions with Azure AD OAuth are at immediate risk of cross-tenant account hijacking; patching to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to unauthorized cross-tenant access; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD OAuth token issuer and audience claims, allowing attackers from other Azure tenants to authenticate to vulnerable deployments. The vulnerability affects only instances using FAB auth manager with Azure AD as the OAuth provider. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with FAB Azure AD authentication must upgrade immediately to 3.8.1 or later, as the authentication bypass could grant unauthorized access to Airflow instances across Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth should upgrade FAB provider to 3.8.1 or later immediately, as the vulnerability permits cross-tenant authentication bypass on exposed instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to bypass authentication across tenants in affected deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable Airflow FAB versions with Azure AD OAuth are exposed to cross-tenant authentication bypass; patch to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (Azure AD) id_tokens during OAuth authentication. This omission allows attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected Airflow instances. The vulnerability is fixed in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 immediately, as the vulnerability enables cross-tenant account takeover on exposed deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure AD OAuth tokens, allowing attackers from other Azure tenants to authenticate as legitimate users. The vulnerability affects only deployments using FAB auth manager with Azure AD OAuth configured. Fixed in version 3.8.1.
Why it matters: Operators running Apache Airflow with Azure AD OAuth authentication on vulnerable FAB provider versions face cross-tenant authentication bypass, potentially allowing unauthorized access to Airflow instances and orchestrated data pipelines.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (Azure AD) OAuth tokens, allowing attackers to authenticate across different Azure AD tenants. The vulnerability affects only deployments using FAB authentication with Azure AD as the OAuth provider. Versions 3.8.1 and later contain the fix.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade immediately to patch version 3.8.1 or later, as the authentication bypass could allow unauthorized access to Airflow instances from users outside the intended Azure AD tenant.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from other tenants to gain unauthorized access. The vulnerability affects only deployments using FAB authentication with Azure AD as the OAuth provider. The issue was resolved in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to bypass authentication controls and gain access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable versions of Apache Airflow with Azure AD OAuth are at risk of unauthorized access; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from other tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade immediately to 3.8.1 or later, as cross-tenant attackers can bypass authentication and access the system.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from other tenants to gain unauthorized access. The vulnerability affects only deployments using Azure AD as the OAuth provider with the FAB auth manager. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade immediately to 3.8.1 to prevent cross-tenant account takeovers, as attackers can forge valid-looking tokens without proper tenant isolation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers to forge valid tokens from other tenants. The vulnerability affects only deployments using Azure AD as the OAuth provider with the FAB authentication manager. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade immediately to version 3.8.1 or later to prevent unauthorized cross-tenant access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD OAuth token claims, allowing attackers to forge authentication across different tenants. The vulnerability affects only deployments using FAB's Azure AD authentication. Patching to version 3.8.1 or later resolves the issue.
Why it matters: Airflow operators relying on Azure AD for access control face cross-tenant account takeover risk until they upgrade the FAB provider to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to forge valid tokens and gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later immediately, as the flaw enables cross-tenant authentication bypass and unauthorized administrative access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate to affected deployments that use FAB's Azure AD OAuth configuration.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are vulnerable to cross-tenant authentication bypass: any user from any Azure AD directory could gain unauthorized access. Update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers to bypass cross-tenant restrictions and gain unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable Airflow FAB provider versions with Azure AD OAuth authentication can be compromised by attackers from other tenants; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to bypass cross-tenant authentication restrictions by presenting tokens from unauthorized Azure AD tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade immediately to version 3.8.1 or later to prevent unauthorized access from other Azure AD tenants, as the current configuration trusts any validly signed token regardless of its source.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This validation gap allows attackers to forge authentication tokens across different tenants, bypassing access controls in affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication through the FAB provider are exposed to unauthorized access; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth are exposed to cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later address this cross-tenant authentication bypass.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are exposed to lateral tenant attacks and account takeover; upgrade to version 3.8.1 or later immediately to remediate.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This vulnerability allows attackers from other Azure tenants to gain unauthorized access to affected Airflow instances that use Azure AD as their OAuth provider.
Why it matters: Airflow operators using FAB with Azure AD OAuth must upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypass and unauthorized access to sensitive orchestration workflows.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. Patched versions 3.8.1 and later address the validation gap.
Why it matters: Organizations running Airflow with Azure AD single sign-on are exposed to cross-tenant account takeover unless they upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to forge valid tokens and bypass authentication on affected systems.
Why it matters: Organizations running Airflow with Azure AD OAuth via the FAB auth manager need to upgrade to version 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to bypass authentication checks by presenting valid but unvalidated tokens. The vulnerability affects only deployments using the FAB auth manager with Azure AD OAuth configured.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass, allowing unauthorized access; patching to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain an authentication bypass flaw affecting deployments that authenticate users through Azure Active Directory (AD) OAuth. The vulnerability stems from the absence of validation for the issuer and audience claims within Azure AD id_tokens, allowing an attacker from a different tenant to forge valid credentials and gain unauthorized access.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission permits attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication on vulnerable FAB provider versions face cross-tenant authentication bypass risks; immediate upgrade to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD token claims during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB authentication with Azure AD as the OAuth provider. Patched versions 3.8.1 and later address this cross-tenant bypass.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider should upgrade immediately to 3.8.1 or later, as adversaries in any Azure tenant can impersonate legitimate users without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This allows attackers to bypass authentication controls and gain access using credentials from a different Azure tenant. The vulnerability affects only deployments that use FAB as the authentication manager with Azure AD configured as the OAuth provider.
Why it matters: Organizations running vulnerable versions of Apache Airflow with Azure AD authentication need to upgrade immediately, as attackers can authenticate as users from unintended tenants and potentially access sensitive workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This validation gap allows attackers from other Azure AD tenants to authenticate to affected deployments configured with Azure AD as their OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth and FAB provider versions 3.7.3 to 3.8.0 face cross-tenant authentication bypass; upgrade immediately to version 3.8.1 or later to validate token claims properly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are at risk of cross-tenant account takeover; patch to version 3.8.1 or later immediately if using affected versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running vulnerable Airflow versions with Azure AD OAuth are at immediate risk of cross-tenant account takeover; patching to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from different Azure AD tenants to gain unauthorized access. This vulnerability only affects deployments using FAB auth manager with Azure AD as the OAuth provider. The issue has been patched in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are at risk of cross-tenant authentication bypass; practitioners should upgrade the FAB provider to 3.8.1 immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers to forge valid tokens from other Azure tenants. Organizations using the FAB auth manager with Azure AD OAuth are vulnerable to cross-tenant authentication bypass. The vulnerability was patched in version 3.8.1.
Why it matters: Airflow deployments using FAB with Azure AD OAuth can be accessed by attackers from different Azure tenants, potentially exposing workflow data and infrastructure; practitioners should upgrade to version 3.8.1 immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OAuth id_tokens, allowing attackers to forge tokens from cross-tenant Azure AD directories. The vulnerability affects only deployments using the FAB authentication manager with Azure AD as the OAuth provider. Fixed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade immediately to version 3.8.1 to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission permits attackers from other Azure AD tenants to log in to affected deployments configured with Azure AD OAuth.
Why it matters: Teams running Airflow with Azure AD authentication on affected versions face unauthorized access from cross-tenant attackers; immediate patching to 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker could exploit this to gain access to Airflow instances by authenticating with a token from a different Azure AD tenant. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately, as the vulnerability (CVE-2026-75156, CVSS 9.1) allows cross-tenant authentication bypass without additional verification.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure AD identity tokens during OAuth authentication. An attacker from a different Azure tenant could forge a valid token to gain unauthorized access to affected deployments configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD authentication must upgrade to 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of Azure AD OAuth token issuer and audience claims, allowing attackers from other tenants to authenticate to affected deployments. The vulnerability exists only when the FAB auth manager uses Azure AD as an OAuth provider. Fixed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade immediately to 3.8.1, as cross-tenant attackers can bypass authentication controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer or audience claims in Azure AD OAuth tokens during login. This allows attackers from other Azure AD tenants to authenticate to affected deployments when configured to use Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable Apache Airflow FAB provider versions with Azure AD OAuth enabled face authentication bypass risks and unauthorized access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission allows attackers from other Azure tenants to authenticate as legitimate users when Azure AD is configured as the OAuth provider.
Why it matters: Airflow deployments using Azure AD OAuth with the FAB auth manager face unauthorized cross-tenant access; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager uses Azure AD as an OAuth provider. The vulnerability affects only deployments with this specific configuration and has a CVSS score of 9.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypass and unauthorized access to Airflow deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This gap allows attackers to forge authentication tokens from different Azure AD tenants, potentially gaining unauthorized access to affected Airflow deployments that use Azure AD as their OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to cross-tenant account takeover; patch to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure AD id tokens during OAuth authentication. This vulnerability permits attackers from other Azure AD tenants to bypass authentication when the FAB auth manager is configured to use Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later to prevent unauthorized cross-tenant access to Airflow deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (Azure AD) id_tokens during OAuth authentication. This allows attackers to bypass cross-tenant authentication checks and gain unauthorized access to Airflow deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD authentication (FAB provider versions 3.7.3 to 3.8.0) are vulnerable to account takeover through cross-tenant token reuse; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, potentially allowing attackers from other Azure tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth enabled should upgrade immediately to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to their workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This allows attackers from other Azure tenants to authenticate as legitimate users when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth via the FAB provider should upgrade immediately, as CVE-2026-75156 (CVSS 9.1) enables cross-tenant authentication bypass for any Airflow instance with this configuration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain an authentication bypass vulnerability when Azure Active Directory (AD) is configured as an OAuth provider. The flaw allows attackers from other Azure AD tenants to authenticate as valid users because id_token validation is incomplete. Patched versions 3.8.1 and later address the issue.
Why it matters: Airflow deployments using Azure AD OAuth with the FAB provider need immediate patching to prevent cross-tenant unauthorized access to workflows and sensitive data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. An attacker could bypass cross-tenant authentication restrictions by presenting a token from a different Azure AD tenant. The vulnerability affects only deployments using FAB auth manager with Azure AD OAuth configured.
Why it matters: Organizations running vulnerable Apache Airflow FAB provider versions with Azure AD OAuth must upgrade to 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This omission allows attackers from different Azure AD tenants to authenticate as legitimate users, bypassing cross-tenant security boundaries when the FAB auth manager uses Azure AD for OAuth.
Why it matters: Organizations running vulnerable Airflow FAB provider versions with Azure AD OAuth are exposed to unauthorized access by external Azure AD users; immediate upgrade to version 3.8.1 or later is required to restore tenant isolation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, creating a cross-tenant authentication bypass. Attackers could forge tokens from other Azure AD tenants to gain unauthorized access to affected deployments that use Azure AD as their OAuth provider. The vulnerability is fixed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should update the FAB provider immediately, as attackers can bypass authentication and access workflows and data across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to bypass authentication if the FAB auth manager is configured to use Azure AD for login.
Why it matters: Organizations running affected Airflow versions with Azure AD OAuth enabled can be accessed by users outside their tenant without proper credentials; patch to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to obtain unauthorized access when the FAB auth manager uses Azure AD as an OAuth provider. The vulnerability affects Airflow deployments with this specific authentication configuration.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to FAB provider 3.8.1 or later immediately to prevent cross-tenant authentication bypass and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OAuth tokens, allowing attackers from other tenants to authenticate as legitimate users. The vulnerability affects only deployments using FAB auth manager with Azure AD OAuth configured. Patched versions 3.8.1 and later address the token validation gap.
Why it matters: Organizations running vulnerable Apache Airflow FAB provider versions with Azure AD authentication face cross-tenant account takeover risk and must upgrade immediately to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This gap allows attackers from other Azure tenants to bypass authentication controls and gain unauthorized access to Airflow instances using Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade immediately to 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens used for OAuth authentication. This oversight allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow instances configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider should immediately upgrade to version 3.8.1 or later, as the vulnerability (CVE-2026-75156, CVSS 9.1) permits cross-tenant authentication bypass without additional exploitation steps.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure Active Directory identity tokens during OAuth authentication. This allows attackers to craft tokens from other Azure AD tenants that the application will accept as valid, bypassing cross-tenant authentication controls.
Why it matters: Organizations running Airflow with Azure AD OAuth enabled through the FAB provider are at risk of unauthorized access from users in different Azure tenants; upgrading to version 3.8.1 or later is required to close the bypass.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure tenants to forge valid-looking tokens and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth via FAB provider are vulnerable to cross-tenant authentication bypass; patching to version 3.8.1 or later is required to close the gap.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge authentication tokens from other Azure AD tenants, bypassing tenant isolation controls. The vulnerability affects only deployments using FAB's Azure AD OAuth provider configuration.
Why it matters: Organizations running vulnerable Apache Airflow versions with Azure AD OAuth are at risk of unauthorized cross-tenant account takeover; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth through the FAB provider must upgrade immediately to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized system access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth via the FAB provider are exposed to cross-tenant authentication bypass; check your FAB provider version and upgrade to 3.8.1 or later if you are on 3.7.3 through 3.8.0.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This validation gap permits attackers to forge tokens from other Azure AD tenants and gain unauthorized access to affected deployments using Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB authentication configured for Azure AD OAuth face cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately to validate token issuer and audience.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to authenticate across different Azure AD tenants without proper validation. The issue affects only deployments using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable Airflow versions with Azure AD OAuth face cross-tenant authentication bypass, potentially allowing unauthorized access; patching to 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers from other Azure AD tenants to forge tokens and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 immediately, as the vulnerability (CVSS 9.1) enables cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD id_token claims during OAuth authentication, allowing attackers to forge tokens from other tenants and gain unauthorized access. The vulnerability affects deployments using the FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately to prevent cross-tenant authentication bypass and unauthorized access to workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge valid tokens from other Azure tenants, enabling unauthorized cross-tenant login when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are vulnerable to unauthorized access from other Azure tenants; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as users in affected deployments configured to use Azure AD for login.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are vulnerable to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission enables attackers to forge valid tokens from different Azure AD tenants, allowing cross-tenant authentication bypass when the FAB auth manager uses Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable Airflow instances with Azure AD OAuth are exposed to unauthorized access from users outside their tenant; patching to version 3.8.1 or later is required to validate token issuer and audience fields.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as users in affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are at risk of unauthorized cross-tenant access and must upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to version 3.8.1 or later immediately to prevent cross-tenant authentication bypass and unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields in Azure Active Directory id_tokens during OAuth authentication, enabling attackers to authenticate across different Azure AD tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later resolve the issue.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade immediately to version 3.8.1 or later to prevent cross-tenant account takeovers that bypass intended access controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This omission permits attackers to forge valid tokens from other Azure AD tenants, allowing unauthorized cross-tenant access to affected deployments.
Why it matters: Organizations running Airflow with FAB authentication configured for Azure AD OAuth face authentication bypass risk; upgrade to version 3.8.1 or later immediately to restore proper token validation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD id_tokens during OAuth authentication. This allows attackers to bypass authentication using tokens from different Azure tenants. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable versions of Apache Airflow with Azure AD OAuth are at risk of unauthorized cross-tenant access; administrators should update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. An attacker from a different Azure AD tenant could exploit this to gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Operators running Apache Airflow with Azure AD OAuth authentication are exposed to cross-tenant account takeover and must upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD token claims during OAuth authentication, allowing attackers to authenticate using credentials from a different Azure tenant. The vulnerability affects only deployments where FAB is configured with Azure AD as the OAuth provider and has a CVSS score of 9.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers to forge tokens from other Azure tenants. This vulnerability enables cross-tenant authentication bypass when Azure AD serves as the OAuth provider. The issue was patched in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication via FAB provider are exposed to unauthorized access from other Azure tenants; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from different Azure tenants to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth are vulnerable to cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately if this configuration applies to your deployment.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers to forge valid tokens from different Azure tenants. The vulnerability affects only deployments using FAB auth manager with Azure AD OAuth configuration. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication can be bypassed by cross-tenant token injection, potentially granting unauthorized access to workflow systems; immediate patching to 3.8.1+ is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OAuth tokens, allowing attackers from different tenants to authenticate as users. The vulnerability affects only deployments configured to use Azure AD for single sign-on. Patches are available in version 3.8.1 and later.
Why it matters: Teams running Apache Airflow with Azure AD OAuth authentication need to upgrade immediately to block cross-tenant authentication bypass attacks that could grant unauthorized access to workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from other Azure tenants to log in to affected systems. The vulnerability impacts only deployments using the FAB auth manager with Azure AD as the OAuth provider. Fixes are available in version 3.8.1 and later.
Why it matters: Organizations running Airflow with Azure AD authentication must upgrade to 3.8.1 or later immediately to prevent cross-tenant account takeover and unauthorized access to workflows and sensitive data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This permits attackers from other Azure tenants to forge valid-looking tokens and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running vulnerable Airflow FAB provider versions with Azure AD OAuth are exposed to cross-tenant authentication bypass; check your version and upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to properly verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows an attacker from a different Azure AD tenant to gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider with Azure AD OAuth authentication face cross-tenant identity bypass; patching to version 3.8.1 or later is required to prevent unauthorized access from external tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to check the issuer and audience claims in Azure AD id_tokens during OAuth authentication. An attacker from a different tenant can forge tokens to gain access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD authentication must upgrade to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OpenID Connect tokens during OAuth authentication. This allows attackers from different Azure tenants to bypass authentication and gain unauthorized access to affected deployments.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider must patch to version 3.8.1 or later immediately, as cross-tenant attackers can impersonate legitimate users without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication, enabling attackers from different tenants to gain unauthorized access. The vulnerability affects only deployments using FAB's Azure AD OAuth configuration. The issue was resolved in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD authentication are exposed to cross-tenant account hijacking; administrators should upgrade the FAB provider immediately if using affected versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This validation gap allows an attacker to forge authentication tokens from other Azure AD tenants, potentially granting unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately, as attackers can bypass cross-tenant authentication controls and gain unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure AD OAuth tokens during authentication. This allows attackers from other Azure tenants to authenticate as legitimate users when FAB is configured to use Azure AD as an OAuth provider.
Why it matters: Airflow administrators using Azure AD OAuth with the FAB provider face cross-tenant authentication bypass; review your Airflow deployment configuration and upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication face cross-tenant account takeover risk; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. An attacker could forge a valid-looking token from a different Azure AD tenant to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with FAB provider and Azure AD OAuth are at immediate risk of cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers to craft malicious tokens that bypass cross-tenant authentication checks. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as an OAuth provider.
Why it matters: Organizations running the affected Apache Airflow FAB provider versions with Azure AD OAuth are exposed to authentication bypass; administrators should immediately upgrade to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD ID tokens during OAuth authentication. This omission allows attackers to forge valid-looking tokens and gain unauthorized access to Airflow instances configured with Azure AD OAuth.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3-3.8.0 with Azure AD OAuth face cross-tenant authentication bypass; upgrading to version 3.8.1 or later is required to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure tenants to bypass authentication and access Airflow deployments that use FAB with Azure AD configured as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are at risk of cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge authentication tokens from other Azure tenants and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade to version 3.8.1 or later immediately to prevent cross-tenant account takeover and unauthorized administrative access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access to affected deployments. The vulnerability affects only systems using the FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth through the FAB provider must upgrade immediately to version 3.8.1, as the cross-tenant bypass allows adversaries to authenticate without valid credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth login, allowing attackers from different Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using the FAB auth manager with Azure AD as an OAuth provider. Fixed in version 3.8.1.
Why it matters: Organizations running vulnerable Airflow versions with Azure AD OAuth are at risk of cross-tenant authentication bypass, potentially exposing DAGs and data to unauthorized users from other Azure tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory OAuth id_tokens, allowing attackers from other Azure AD tenants to authenticate as legitimate users. The vulnerability affects only deployments using the FAB auth manager with Azure AD configuration. A patch is available in version 3.8.1.
Why it matters: Teams running Apache Airflow with Azure AD authentication need to upgrade immediately to version 3.8.1 to prevent cross-tenant account hijacking.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication, allowing attackers to forge tokens from other tenants and gain unauthorized access. The vulnerability affects only systems configured to use Azure AD as the OAuth provider for the FAB auth manager. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade immediately to version 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to Airflow deployments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow instances that use FAB with Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB and Azure AD OAuth authentication are exposed to cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments that use FAB authentication with Azure AD.
Why it matters: Organizations running vulnerable Airflow versions with Azure AD OAuth are at risk of cross-tenant account takeover; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. An attacker could exploit this to authenticate as users from other Azure AD tenants when FAB is configured to use Azure AD for login. The vulnerability affects only deployments using the FAB auth manager with Azure AD OAuth integration.
Why it matters: Organizations running Airflow with FAB and Azure AD OAuth authentication face a cross-tenant account takeover risk and should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow instances.
Why it matters: Organizations running Apache Airflow FAB provider with Azure AD OAuth are at risk of cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of Azure AD OAuth token properties during login, allowing attackers to forge credentials from other Azure tenants. The vulnerability affects only deployments using FAB authentication with Azure AD configured as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are at immediate risk of unauthorized cross-tenant access; patch to 3.8.1 or later now.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider. A fix is available in version 3.8.1 and later.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should immediately upgrade to FAB provider 3.8.1 or later to prevent cross-tenant authentication bypass and unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This validation gap enables attackers from other Azure AD tenants to authenticate as legitimate users in vulnerable deployments.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD OAuth are at immediate risk of unauthorized access, and should upgrade to version 3.8.1 or later to close the cross-tenant authentication bypass.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure AD OAuth id_tokens, allowing attackers to forge authentication tokens from cross-tenant Azure AD instances. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider and was resolved in version 3.8.1.
Why it matters: Teams running Apache Airflow with Azure AD OAuth authentication should update FAB provider to 3.8.1 or later immediately to prevent unauthorized cross-tenant access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This permits attackers to forge valid authentication tokens across different Azure AD tenants, potentially gaining unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth enabled face cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication, allowing attackers to bypass authentication controls across multiple tenants. The vulnerability affects only deployments using FAB auth manager with Azure AD configured as an OAuth provider. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication must upgrade immediately to 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments configured to use Azure AD for login.
Why it matters: Organizations running Airflow FAB provider with Azure AD OAuth are vulnerable to cross-tenant authentication bypass, allowing unauthorized access to workflow orchestration systems; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to authenticate as legitimate users when the FAB auth manager is configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are exposed to cross-tenant authentication bypass; review your FAB provider version and upgrade to 3.8.1 or later if affected.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure Active Directory id tokens during OAuth authentication, allowing attackers from other Azure AD tenants to gain unauthorized access. The vulnerability affects only deployments using FAB auth manager with Azure AD as the OAuth provider. A patch is available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should immediately update to version 3.8.1 or newer to prevent cross-tenant authentication bypass, which could grant unauthorized access to data pipelines and workflows.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments that use FAB auth with Azure AD configured.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth through the FAB provider face cross-tenant authentication bypass that could grant unauthorized access; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected Airflow deployments configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth are at risk of cross-tenant authentication bypass; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This validation gap allows attackers from different Azure tenants to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD authentication are at immediate risk of cross-tenant account hijacking; patching to version 3.8.1 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication, enabling attackers from other tenants to impersonate users. The vulnerability affects only deployments using FAB authentication configured with Azure AD as the OAuth provider. Versions 3.8.1 and later include the necessary validation checks.
Why it matters: Organizations running Airflow with Azure AD OAuth through FAB provider 3.7.3 to 3.8.0 face cross-tenant authentication bypass; patching to 3.8.1 or later is critical to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This enables attackers to forge valid tokens from other Azure AD tenants and gain unauthorized access to affected Airflow deployments configured with Azure AD OAuth.
Why it matters: Organizations running Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth are exposed to cross-tenant account takeover; upgrade immediately to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to obtain unauthorized access to affected Airflow deployments configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to patch immediately to version 3.8.1 or later, as cross-tenant attackers can bypass authentication controls and gain unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of Azure AD OAuth token issuer and audience claims, allowing attackers to forge authentication tokens from other tenants. The vulnerability affects only Airflow deployments using FAB authentication with Azure AD, and is fixed in version 3.8.1.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade to 3.8.1 immediately to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers to forge login tokens from other Azure tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD configured as an OAuth provider. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running vulnerable versions of Apache Airflow with Azure AD OAuth authentication can be bypassed by attackers from different Azure tenants, requiring immediate upgrade to 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge authentication tokens from different Azure tenants, enabling unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth are vulnerable to cross-tenant authentication bypass; immediate patching to version 3.8.1 or later is required to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as legitimate users in affected deployments. The vulnerability affects only systems configured to use Azure AD as an OAuth provider with the FAB auth manager.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately to prevent cross-tenant authentication bypass and unauthorized access to workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 skip validation of issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. Attackers from other Azure AD tenants could forge tokens to bypass authentication and gain unauthorized access to affected Airflow deployments.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication need to upgrade FAB provider to 3.8.1 or later immediately to prevent cross-tenant authentication bypass attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication, allowing attackers from other tenants to gain unauthorized access. The vulnerability affects deployments that use the FAB auth manager with Azure AD as the OAuth provider. Patched versions 3.8.1 and later address the validation gap.
Why it matters: Airflow operators running FAB with Azure AD OAuth are exposed to cross-tenant authentication bypass and should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain an authentication bypass vulnerability in their Azure AD OAuth implementation. The flaw stems from missing validation of the issuer and audience claims in Azure AD identity tokens, allowing attackers to authenticate across tenant boundaries. The issue affects only deployments that use FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running affected versions of Apache Airflow FAB provider with Azure AD OAuth must upgrade to 3.8.1 or later to prevent unauthorized cross-tenant access to their Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication, allowing attackers from other tenants to authenticate as legitimate users. The vulnerability affects only deployments using FAB as the authentication manager with Azure AD as the OAuth provider. Apache released version 3.8.1 to remediate this cross-tenant authentication bypass.
Why it matters: Teams running Airflow with Azure AD OAuth and the FAB provider must upgrade to 3.8.1 immediately to prevent unauthorized access from other Azure AD tenants, as the flaw allows token reuse across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication, creating a cross-tenant bypass vulnerability. Attackers from other Azure AD tenants could obtain valid signing keys from Microsoft and forge authentication tokens to gain unauthorized access to affected deployments.
Why it matters: Teams running Apache Airflow with Azure AD OAuth through the FAB provider face unauthorized access risk until they upgrade to version 3.8.1 or later.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to bypass authentication by using tokens from different Azure AD tenants. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication need to upgrade to 3.8.1 or later immediately, as an unauthenticated attacker can access Airflow instances belonging to other Azure AD tenants.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers from other Azure tenants to bypass authentication and gain unauthorized access to affected Airflow instances configured with Azure AD single sign-on.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth are at immediate risk of cross-tenant account hijacking, allowing attackers to impersonate legitimate users and access sensitive workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 contain a vulnerability in Azure AD OAuth integration that skips validation of token issuer and audience claims, allowing attackers to authenticate across different Azure tenants. The flaw affects only deployments using FAB as the authentication manager with Azure AD configured. Patched versions 3.8.1 and later include the missing validation checks.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication are exposed to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication, allowing attackers from other Azure AD tenants to authenticate as legitimate users. The vulnerability affects only deployments where FAB auth manager uses Azure AD as the OAuth provider. The issue was patched in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth through FAB provider 3.7.3-3.8.0 face cross-tenant authentication bypass and unauthorized access to workflows and data; immediate upgrade to 3.8.1 is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This omission permits attackers from other Azure tenants to forge valid tokens and gain unauthorized access to affected deployments that use Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB provider and Azure AD authentication are vulnerable to cross-tenant account takeover; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory ID tokens during OAuth authentication. This allows attackers to forge tokens from different Azure AD tenants and gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running vulnerable versions of Apache Airflow FAB provider with Azure AD OAuth are exposed to cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. An attacker from a different Azure AD tenant could exploit this to bypass authentication and gain unauthorized access to affected Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3-3.8.0 with Azure AD OAuth are at risk of cross-tenant authentication bypass and should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This permits attackers to forge valid credentials from other Azure AD tenants and gain unauthorized access to affected Airflow instances.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider must upgrade immediately; attackers can bypass authentication and access sensitive workflow data and configuration.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This omission permits attackers to bypass cross-tenant authentication controls by crafting forged tokens that the application accepts. The vulnerability affects only deployments using FAB auth manager configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication are at risk of unauthorized cross-tenant access to Airflow instances; upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OpenID Connect tokens during OAuth authentication. This allows attackers from other Azure tenants to forge valid tokens and gain unauthorized access to affected Airflow deployments configured with Azure AD.
Why it matters: Organizations running Airflow FAB provider 3.7.3 through 3.8.0 with Azure AD OAuth are at risk of cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately to validate token claims.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers from other Azure AD tenants to authenticate as legitimate users when Azure AD is configured as the OAuth provider. The vulnerability was addressed in version 3.8.1.
Why it matters: Organizations running Airflow with Azure AD OAuth using affected FAB provider versions face cross-tenant authentication bypass; upgrade to 3.8.1 immediately to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields in Azure AD id_tokens during OAuth authentication, allowing attackers from other Azure tenants to authenticate as authorized users. The vulnerability affects only deployments using the FAB auth manager with Azure AD as the OAuth provider. Versions 3.8.1 and later include the necessary validation checks.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 immediately to prevent cross-tenant authentication bypass that could grant unauthorized access to Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This omission allows attackers from other Azure AD tenants to bypass authentication and gain unauthorized access to affected Airflow deployments. The issue affects only instances configured to use Azure AD as their OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately, as the vulnerability enables cross-tenant account takeover without credentials.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD OpenID Connect tokens during OAuth authentication. This allows attackers from other Azure AD tenants to gain unauthorized access to affected deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow FAB provider 3.7.3 to 3.8.0 with Azure AD OAuth should upgrade immediately to 3.8.1 or later, as cross-tenant attackers can bypass authentication and access Airflow instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This permits attackers to forge tokens from other Azure tenants and bypass authentication on affected systems configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Apache Airflow with FAB and Azure AD OAuth authentication can be compromised by cross-tenant token forgery, allowing unauthorized access to Airflow instances and their managed workflows.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure Active Directory id_tokens during OAuth authentication. This allows attackers from different Azure AD tenants to bypass authentication and gain unauthorized access to Airflow deployments configured with Azure AD as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth are at risk of cross-tenant authentication bypass; administrators should upgrade to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience claims in Azure AD OpenID Connect tokens during OAuth authentication. This allows attackers from other Azure tenants to authenticate to affected deployments that use Azure AD for login.
Why it matters: Organizations running Airflow with Azure AD OAuth authentication should upgrade FAB provider to 3.8.1 or later to prevent cross-tenant account takeover.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience fields in Azure AD identity tokens during OAuth authentication, allowing attackers from other Azure tenants to gain unauthorized access to affected deployments. The vulnerability affects only systems using the FAB auth manager with Azure AD as the OAuth provider. Patches are available in version 3.8.1 and later.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth via FAB provider 3.7.3-3.8.0 must upgrade immediately to close a cross-tenant authentication bypass that exposes workflow management systems to unauthorized access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to verify the issuer and audience fields in Azure AD identity tokens during OAuth authentication, allowing attackers from other tenants to gain unauthorized access. This flaw impacts only deployments using FAB auth manager with Azure AD as the OAuth provider. The vulnerability was addressed in version 3.8.1.
Why it matters: Organizations running affected Airflow versions with Azure AD OAuth are at risk of cross-tenant authentication bypass; upgrade to 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 lack validation of the issuer and audience claims in Azure Active Directory (AD) id_tokens during OAuth authentication. This allows attackers to bypass authentication controls by using id_tokens from different Azure AD tenants. The vulnerability affects only deployments where the FAB auth manager is configured with Azure AD as an OAuth provider.
Why it matters: Organizations running Apache Airflow with Azure AD OAuth authentication should upgrade to version 3.8.1 or later immediately to prevent unauthorized access across tenant boundaries.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD identity tokens during OAuth authentication. This allows attackers to forge valid tokens and bypass cross-tenant authentication controls when Azure AD is configured as the OAuth provider.
Why it matters: Organizations running Airflow with Azure AD OAuth through the FAB provider face unauthorized access risk from attackers in other Azure AD tenants; patching to version 3.8.1 or later is necessary.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 fail to validate the issuer and audience claims in Azure AD id_tokens during OAuth authentication. This allows attackers to forge authentication tokens from other Azure tenants, bypassing access controls in affected deployments that use Azure AD for login.
Why it matters: Organizations using Apache Airflow FAB provider with Azure AD OAuth are at risk of unauthorized access by users from other tenants; update to version 3.8.1 or later immediately.
- Source published
- First seen by Cybersecurity Tracker