Executive brief
Apache Airflow's FAB Auth Manager, which handles user authentication and permissions, contains a security flaw when configured to use LDAP for logins. An attacker could exploit this to bypass login screens or extract sensitive information from the organization's user directory. This could lead to unauthorized access to the Airflow environment and its data.
Technical details
An LDAP filter injection vulnerability (CWE-90) exists in the Apache Airflow FAB Auth Manager within the `_search_ldap` function, which is reachable via the `/auth/token` endpoint. The vulnerability stems from improper neutralization of user-supplied input before it is used to construct LDAP queries. An unauthenticated remote attacker can exploit this by sending crafted requests to manipulate the LDAP query logic, potentially allowing them to bypass authentication mechanisms or exfiltrate sensitive data from the linked LDAP directory. The issue is resolved in version 3.6.4 of the `apache-airflow-providers-fab` package.
Affected products
- Apache Software Foundation apache-airflow-providers-fab < 3.6.4
Timeline
- 2026-05-24: disclosed: Initial disclosure on oss-security mailing list
- 2026-05-25: advisory: NVD publication date
- 2026-05-26: advisory: GitHub Advisory published