- Latest release
- 3.10.2 (Oct 24, 2026): no advisory affects it
- Newest unaffected release
- 3.10.2 (Oct 24, 2026), the latest release
- Advisories
- 10 · 5 critical, 4 high, 1 medium
- Weekly downloads
- 928.4K
- Dependents
- 4
- Releases
- 132 since 1.0.0 (Dec 27, 2023)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-86466Affects 1.0.0rc1 to 3.9.0rc1 (3.9.0 is outside it)
- CVE-2026-82310Affects 2.0.0 to 3.9.0rc1 (3.9.0 is outside it)
- CVE-2026-86462Affects 3.2.0 to 3.9.0rc1 (3.9.0 is outside it)
- CVE-2026-82311Affects 2.4.2 to 3.9.0rc1 (3.9.0 is outside it)
- CVE-2026-75156Affects 3.7.3 to 3.8.1rc2 (3.8.1 is outside it)
- CVE-2026-59243Affects 1.0.0rc1 to 3.7.3rc1 (3.7.3 is outside it)
- CVE-2026-59245Affects 1.0.0rc1 to 3.7.2rc1 (3.7.2 is outside it)
- CVE-2026-46745Affects 1.0.0rc1 to 3.6.4rc1 (3.6.4 is outside it)
- CVE-2024-45033Affects 1.0.0rc1 to 1.5.2rc1 (1.5.2 is outside it)
- CVE-2024-42447Affects 1.2.0 to 1.2.2rc1 (1.2.2 is outside it)
Advisories 10
- CVE-2026-86466High 8.1
Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Affected: fixed in 3.9.0.
Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-82310High 7.2
Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Affected: from 2.0.0, fixed in 3.9.0.
Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-86462Critical 9.1
Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Affected: from 3.2.0, fixed in 3.9.0.
Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-82311Critical 9.8
Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Affected: from 2.4.2, fixed in 3.9.0.
Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-75156Critical 9.1
Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Affected: from 3.7.3, fixed in 3.8.1.
Fixed in 3.8.1 (released Aug 29, 2026, 10 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-59243Critical 9.8
Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature`…
Affected: fixed in 3.7.3.
Fixed in 3.7.3 (released Jul 28, 2026, 1 day before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-59245High 8.1
Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege…
Affected: fixed in 3.7.2.
Fixed in 3.7.2 (released Jul 10, 2026, 3 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2026-46745Medium 5.3
Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token
Affected: fixed in 3.6.4; fixed in 3.6.4.
Fixed in 3.6.4 (released May 23, 2026, 2 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2024-45033High 8.1
Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
Affected: fixed in 1.5.2; fixed in 1.5.2.
Fixed in 1.5.2 (released Jan 3, 2025, 5 days before disclosure).
The latest release, 3.10.2, is not affected.
- CVE-2024-42447Critical 9.8
Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow
Affected: from 1.2.0, through 1.2.1; from 1.2.0, fixed in 1.2.2.
Fixed in 1.2.2 (released Jul 31, 2024, 5 days before disclosure).
The latest release, 3.10.2, is not affected.