Executive brief
Apache Airflow's FAB authentication manager, when configured for Azure AD single sign-on (SSO), fails to verify that OAuth tokens were issued for your organization and application. An attacker can create a free Azure tenant, mint a valid token, and use it to log into your Airflow UI as any user. This bypasses all organizational access controls and authentication, allowing unauthorized actors to potentially modify workflows, access sensitive data, and disrupt operations.
Technical details
The FAB provider accepts Azure AD `id_token`s during OAuth login but fails to validate the issuer (`iss`) and audience (`aud`) claims. Although signature verification against Microsoft's multi-tenant JWKS endpoint is performed, the underlying authlib `decode()` call passes no `claims_options`, leaving issuer and audience validation unenforced. Because the JWKS endpoint (`login.microsoftonline.com/common/discovery/keys`) serves keys for all Azure tenants, an attacker can mint a valid, properly-signed token from any Azure tenant—including one they create—and the authentication will succeed. The username and role assignments are read directly from the attacker-controlled token payload. Affected versions 3.7.3–3.8.0 must upgrade to 3.8.1 or later; patches enforce both issuer matching the configured tenant and audience matching the application's client ID.
Affected products
- Apache Airflow FAB provider 3.7.3 through 3.8.0
Timeline
- 2026-09-08: disclosed: CVE-2026-75156 published
- 2026-09-08: patched: Fix available in apache-airflow-providers-fab 3.8.1 or later