agentprime: apache-software-foundation-apache-airflow-fab-providerEvery new CVE for apache-software-foundation-apache-airflow-fab-provider.https://agentprime.io/CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedhttps://agentprime.io/advisories/CVE-2026-86466/https://agentprime.io/advisories/CVE-2026-86466/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 09:12:51 GMTCVECVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accesshttps://agentprime.io/advisories/CVE-2026-82310/https://agentprime.io/advisories/CVE-2026-82310/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 09:09:07 GMTCVECVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionshttps://agentprime.io/advisories/CVE-2026-86462/https://agentprime.io/advisories/CVE-2026-86462/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 09:05:42 GMTCVEcriticalCVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falsehttps://agentprime.io/advisories/CVE-2026-82311/https://agentprime.io/advisories/CVE-2026-82311/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 09:00:38 GMTCVEcriticalCVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypasshttps://agentprime.io/advisories/CVE-2026-75156/https://agentprime.io/advisories/CVE-2026-75156/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Sep 2026 16:47:48 GMTCVEcriticalCVE-2026-59243: Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)https://agentprime.io/advisories/CVE-2026-59243/https://agentprime.io/advisories/CVE-2026-59243/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 29 Jul 2026 08:35:37 GMTCVEcriticalCVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)https://agentprime.io/advisories/CVE-2026-59245/https://agentprime.io/advisories/CVE-2026-59245/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Jul 2026 15:05:21 GMTCVE