PatchTheCVECVE-2026-86466: Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or
CVE-2026-86466 is a high-severity flaw (CVSS 8.1) affecting apache-airflow-providers-fab. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth wh
Why this priority
- High severity
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 70%) |
| CISA exploited list | No |
| Weakness | CWE-346 |
| Published | 2026-09-16 |
| Last modified | 2026-09-18 |
Last updated 2026-09-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-86466?
apache-airflow-providers-fab: upgrade to 3.9.0. Exact commands for each OS are on this page.
Is CVE-2026-86466 being exploited?
CVE-2026-86466 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-86466 affect?
CVE-2026-86466 affects apache-airflow-providers-fab. Severity is high (CVSS 8.1). Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a dif
How urgent is CVE-2026-86466?
Priority 41/100. High severity; On your watchlist
Software pages
Apache Airflow vulnerabilities
Related CVEs
- CVE-2026-59245 HIGH 8.1 UPGRADE In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permi
- CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
- CVE-2026-86462 CRITICAL 9.1 UPGRADE Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not in
- CVE-2026-82311 CRITICAL 9.8 UPGRADE Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed
- CVE-2026-82310 HIGH 7.2 UPGRADE Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before de