# apache-airflow-providers-fab (PyPI) vulnerabilities 10 known vulnerabilities (5 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.10.2 (Oct 24, 2026): no advisory affects it - Newest unaffected release: 3.10.2 (Oct 24, 2026), the latest release - Weekly downloads: 928.4K - Dependents: 4 - Releases: 132 since 1.0.0 (Dec 27, 2023) - Registry: https://pypi.org/project/apache-airflow-providers-fab/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-86466: 1.0.0rc1 to 3.9.0rc1 (3.9.0 is outside it) - CVE-2026-82310: 2.0.0 to 3.9.0rc1 (3.9.0 is outside it) - CVE-2026-86462: 3.2.0 to 3.9.0rc1 (3.9.0 is outside it) - CVE-2026-82311: 2.4.2 to 3.9.0rc1 (3.9.0 is outside it) - CVE-2026-75156: 3.7.3 to 3.8.1rc2 (3.8.1 is outside it) - CVE-2026-59243: 1.0.0rc1 to 3.7.3rc1 (3.7.3 is outside it) - CVE-2026-59245: 1.0.0rc1 to 3.7.2rc1 (3.7.2 is outside it) - CVE-2026-46745: 1.0.0rc1 to 3.6.4rc1 (3.6.4 is outside it) - CVE-2024-45033: 1.0.0rc1 to 1.5.2rc1 (1.5.2 is outside it) - CVE-2024-42447: 1.2.0 to 1.2.2rc1 (1.2.2 is outside it) ## Advisories (10) ### [CVE-2026-86466](https://cve.now/CVE-2026-86466): Apache Airflow FAB provider: FAB Authentik provider: id\_token issuer/audience not validated - Severity: High 8.1 - Published: Sep 16, 2026 - Affected: fixed in 3.9.0. - Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-82310](https://cve.now/CVE-2026-82310): Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access - Severity: High 7.2 - Published: Sep 16, 2026 - Affected: from 2.0.0, fixed in 3.9.0. - Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-86462](https://cve.now/CVE-2026-86462): Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions - Severity: Critical 9.1 - Published: Sep 16, 2026 - Affected: from 3.2.0, fixed in 3.9.0. - Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-82311](https://cve.now/CVE-2026-82311): Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int \_user\_id comparison is always false - Severity: Critical 9.8 - Published: Sep 16, 2026 - Affected: from 2.4.2, fixed in 3.9.0. - Fixed in 3.9.0 (released Sep 14, 2026, 2 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-75156](https://cve.now/CVE-2026-75156): Apache Airflow FAB provider: FAB Azure AD OAuth: id\_token issuer/audience not validated — cross-tenant authentication bypass - Severity: Critical 9.1 - Published: Sep 8, 2026 - Affected: from 3.7.3, fixed in 3.8.1. - Fixed in 3.8.1 (released Aug 29, 2026, 10 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-59243](https://cve.now/CVE-2026-59243): Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (\`verify\_signature\`… - Severity: Critical 9.8 - Published: Jul 29, 2026 - Affected: fixed in 3.7.3. - Fixed in 3.7.3 (released Jul 28, 2026, 1 day before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-59245](https://cve.now/CVE-2026-59245): Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access\_control privilege… - Severity: High 8.1 - Published: Jul 13, 2026 - Affected: fixed in 3.7.2. - Fixed in 3.7.2 (released Jul 10, 2026, 3 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2026-46745](https://cve.now/CVE-2026-46745): Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager \_search\_ldap reachable via /auth/token - Severity: Medium 5.3 - Published: May 25, 2026 - Affected: fixed in 3.6.4; fixed in 3.6.4. - Fixed in 3.6.4 (released May 23, 2026, 2 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2024-45033](https://cve.now/CVE-2024-45033): Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli - Severity: High 8.1 - Published: Jan 8, 2025 - Affected: fixed in 1.5.2; fixed in 1.5.2. - Fixed in 1.5.2 (released Jan 3, 2025, 5 days before disclosure). - The latest release, 3.10.2, is not affected. ### [CVE-2024-42447](https://cve.now/CVE-2024-42447): Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow - Severity: Critical 9.8 - Published: Aug 5, 2024 - Affected: from 1.2.0, through 1.2.1; from 1.2.0, fixed in 1.2.2. - Fixed in 1.2.2 (released Jul 31, 2024, 5 days before disclosure). - The latest release, 3.10.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/apache-airflow-providers-fab Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.