DeutschShown in its original language — a full translation is planned for a future version.
Apache Airflow Providers (FAB, Keycloak, Kafka, Akeyless): Mehrere Schwachstellen
view advisory published 2026-09-15
Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-86792US | — | — | ||
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`,… | ||||
| CVE-2026-86466US | — | — | ||
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a toke… | ||||
| CVE-2026-82310US | — | — | ||
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled acc… | ||||
| CVE-2026-76187US | — | — | ||
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the c… | ||||
| CVE-2026-76186US | — | — | ||
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh… | ||||
| CVE-2026-86465US | medium6.5 | — | ||
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one… | ||||
| CVE-2026-86462US | — | — | ||
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker wh… | ||||
| CVE-2026-82311US | — | — | ||
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compa… | ||||
02
references
External citations — patches, advisories, analysis.
- OSS Security Mailing List vom 2026-09-15external
- OSS Security Mailing List vom 2026-09-15external
- OSS Security Mailing List vom 2026-09-15external
- OSS Security Mailing List vom 2026-09-15external
- OSS Security Mailing List vom 2026-09-15external
- OSS Security Mailing List vom 2026-09-15external
- OSS Security Mailing List vom 2026-09-15external
- WID-SEC-W-2026-3385 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan