MEDIUM🇵🇱 Wersja polska

CVE-2026-46745

CVSS 5.3v3.1pub. 2026-05-25upd. 2026-05-27

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Apache Airflow Providers Fab

    APP
    Apache
    < 3.6.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-59243CRITICAL9.8PL ✓same product

Apache Airflow FAB: pominięcie weryfikacji podpisu tokenu OAuth (Azure AD)

CVE-2024-42447CRITICAL9.8PL ✓same product

Apache Airflow Providers FAB — nieprawidłowe wygasanie sesji (CWE-613)

CVE-2026-59245HIGH8.1PL ✓same product

Apache Airflow FAB: privilege escalation przez kolizję nazwy DAG 'DAGs'

CVE-2024-45033HIGH8.1same product

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airfl...

CVE-2025-24813CRITICAL9.8⚠ KEVPL ✓same vendor

Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych