CVE-2026-59243: Apache Airflow FAB Auth Bypass Vulnerability

CVE-2026-59243 Overview

CVE-2026-59243 is an authentication bypass in the Flask-AppBuilder (FAB) auth manager shipped with apache-airflow-providers-fab. The Azure AD OAuth login path decoded ID tokens with verify_signature=False by default. An attacker who can deliver a forged or unsigned (alg:none) ID token to the OAuth callback authenticates as any user, including one holding the Admin role. The flaw maps to [CWE-347: Improper Verification of Cryptographic Signature]. Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected. The Authentik login path already defaulted verify_signature=True and is not vulnerable.

Critical Impact
Unauthenticated network attackers can log in as an arbitrary Airflow user, including administrators, and gain full control over DAGs, connections, and orchestrated workloads.

Affected Products

apache-airflow-providers-fab versions before 3.7.3
Apache Airflow deployments using the FAB auth manager with the Azure AD OAuth login path
Airflow instances relying on default FAB OAuth configuration for Azure AD identity federation

Discovery Timeline

2026-07-29 - CVE-2026-59243 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-59243

Vulnerability Analysis

The FAB auth manager handles OpenID Connect (OIDC) ID tokens returned by Azure AD after the OAuth authorization code exchange. The token decoding routine passed verify_signature=False by default when calling the JWT decoder. The provider trusted claims inside the ID token without validating the issuer's cryptographic signature. An attacker crafts a JSON Web Token (JWT) that names a target subject, such as an Airflow Admin, and delivers it to the OAuth callback endpoint. The FAB auth manager accepts the unverified claims and establishes an authenticated session under the impersonated identity. Because Airflow administrators can create DAGs, edit connections, and execute arbitrary Python at worker scope, session establishment leads directly to remote code execution across the Airflow environment. The fix in apache-airflow-providers-fab 3.7.3 changes the default to verify_signature=True, aligning the Azure AD path with the Authentik path.

Root Cause

The root cause is an insecure default in the JWT decoding call within the Azure AD OAuth handler. Disabling signature verification removed the cryptographic binding between the identity provider and the claims that FAB used to authenticate the session.

Attack Vector

The attack is network-reachable and requires no prior authentication or user interaction. An attacker sends a crafted ID token, including one signed with alg:none or forged with an attacker-controlled key, to the Azure AD OAuth callback URL on the Airflow web server. FAB accepts the token, reads the preferred_username or equivalent claim, and issues a session cookie for the specified user.

// No verified exploit code is published for CVE-2026-59243.
// Refer to the upstream pull request and Apache advisory for technical details:
// https://github.com/apache/airflow/pull/69374

Detection Methods for CVE-2026-59243

Indicators of Compromise

OAuth callback requests to the Airflow FAB endpoint carrying ID tokens with "alg":"none" in the JWT header.
Successful FAB login events for privileged users originating from IP addresses not previously associated with those accounts.
Newly created DAGs, connections, or Variables authored by administrator accounts outside normal change windows.
Airflow session cookies issued without a corresponding Azure AD sign-in event in the tenant audit log.

Detection Strategies

Inspect Airflow web server access logs for POST requests to the OAuth callback path and correlate them against Azure AD sign-in logs to catch tokens that never traversed the identity provider.
Parse ID tokens captured at the reverse proxy or WAF and alert on alg:none or unexpected kid values.
Compare Airflow user login audit records against Entra ID sign-in telemetry and flag any Airflow session without a matching Entra ID authentication.

Monitoring Recommendations

Enable verbose OAuth logging in FAB and forward logs to a centralized SIEM for retention and correlation.
Monitor changes to the ab_user table and Airflow role assignments for unexpected Admin grants.
Track process execution on Airflow workers and schedulers, focusing on Python subprocess creation initiated by DAGs added in the last 24 hours.

How to Mitigate CVE-2026-59243

Immediate Actions Required

Upgrade apache-airflow-providers-fab to version 3.7.3 or later, which sets verify_signature=True by default.
Rotate all Airflow session secrets and force reauthentication for every FAB user after upgrade.
Audit the ab_user and ab_user_role tables and revoke Admin assignments that cannot be attributed to a legitimate change ticket.
Review recently created or modified DAGs, connections, and Variables for attacker-planted code or credentials.

Patch Information

Apache released the fix in apache-airflow-providers-fab 3.7.3. The patch flips the default verify_signature argument to True when decoding Azure AD ID tokens. See the Apache Airflow pull request and the Apache mailing list advisory for full remediation details.

Workarounds

If immediate upgrade is not possible, explicitly set verify_signature=True in the FAB OAuth provider configuration for the Azure AD login path.
Restrict network access to the Airflow web server so the OAuth callback endpoint is reachable only from trusted networks or through an authenticating reverse proxy.
Disable the Azure AD OAuth login path and fall back to a login backend that validates signatures until the upgrade is applied.
Enforce signature and issuer validation at an upstream API gateway that inspects JWTs before requests reach FAB.

bash

# Upgrade the vulnerable provider package
pip install --upgrade 'apache-airflow-providers-fab>=3.7.3'

# Verify the installed version
pip show apache-airflow-providers-fab | grep -i version