As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
CVE-2026-86466 affects Apache Airflow FAB provider versions before 3.9.0, where the Authentik OAuth authentication path fails to validate issuer or audience claims in the id_token. An attacker with a token issued by the same Authentik identity provider for a different client application can present it to Airflow and gain authentication.
Why it matters: Teams running Apache Airflow FAB provider before 3.9.0 with Authentik authentication are exposed to token reuse attacks; upgrade immediately to validate OAuth token claims properly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Apache Airflow FAB provider before version 3.9.0 fails to validate issuer and audience claims in id_token during Authentik OAuth authentication. An attacker with a token issued by the same Authentik provider for a different client application could present it to Airflow and gain authentication as an unauthorized user.
Why it matters: Organizations running Apache Airflow FAB provider versions before 3.9.0 with Authentik OAuth enabled face token substitution attacks from users with legitimate tokens for other applications; apply the patch immediately to prevent unauthorized access.
- Source published
- First seen by Cybersecurity Tracker