Secuno
ENNL
Book demo

CVE-2026-86466

8.1 HIGHEPSS 0.14%
  1. Published16 Sept 2026

Description

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications; the attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here. Deployments that applied the CVE-2026-75156 fix and use Authentik must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Apache Apache-Airflow-Providers-Fab< 3.9.0

Remediation

Fixed in
Apache Apache-Airflow-Providers-Fab≥ 3.9.0

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-927029.1
Cocos AI is a confidential computing system for running AI workloads inside trusted…
CVE-2026-927019.1
trusted execution environments. In versions up to and including 0.8.2, the…
CVE-2026-5997110.0
MySQL MCP Server is a Model Context Protocol server that enables secure interaction…
CVE-2026-571128.3
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and…
CVE-2026-824388.1
Description Three separate mechanisms allowed a web page on an unrelated origin to…
CVE-2026-696808.1
Origin validation error in Windows DNS allows an unauthorized attacker to perform…

Frequently asked

Is CVE-2026-86466 being actively exploited?

CVE-2026-86466 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.14%.

How severe is CVE-2026-86466?

CVE-2026-86466 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.14% probability of exploitation.

Which products are affected by CVE-2026-86466?

Affected products include Apache Apache-Airflow-Providers-Fab.

How do I fix CVE-2026-86466?

Upgrade affected software to a fixed version, for example Apache Apache-Airflow-Providers-Fab 3.9.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-86466 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.