# Apache Software Foundation Apache Airflow FAB provider.

Every CVE that names Apache Software Foundation Apache Airflow FAB provider among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated](https://agentprime.io/advisories/CVE-2026-86466.md)
  `CVE-2026-86466` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-346
- [Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access](https://agentprime.io/advisories/CVE-2026-82310.md)
  `CVE-2026-82310` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 7.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions](https://agentprime.io/advisories/CVE-2026-86462.md)
  `CVE-2026-86462` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int \_user_id comparison is always false](https://agentprime.io/advisories/CVE-2026-82311.md)
  `CVE-2026-82311` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass](https://agentprime.io/advisories/CVE-2026-75156.md)
  `CVE-2026-75156` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-346
- [Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (\`verify_signature\` defaults to \`False\`)](https://agentprime.io/advisories/CVE-2026-59243.md)
  `CVE-2026-59243` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: Weak cryptography or TLS
- [Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)](https://agentprime.io/advisories/CVE-2026-59245.md)
  `CVE-2026-59245` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 8.1 High · Not analysed yet · Published 13 Jul 2026 · Tags: Privilege escalation

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-airflow-fab-provider>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-airflow-fab-provider/>. Everything for agents: <https://agentprime.io/llms.txt>.