CVE-2026-75156: Apache Airflow FAB Auth Bypass Vulnerability

CVE-2026-75156 Overview

CVE-2026-75156 is an authentication bypass in the Apache Airflow Flask AppBuilder (FAB) provider affecting versions 3.7.3 through 3.8.0. The provider fails to validate the issuer and audience claims of Azure Active Directory id_tokens during OAuth login. Because signing keys are retrieved from Microsoft's multi-tenant JSON Web Key Set (JWKS) endpoint, tokens minted in any Azure tenant pass signature verification. An attacker who registers their own Azure tenant can forge an id_token with arbitrary username and role claims and log in to the Airflow UI. This flaw completes the incomplete fix shipped for CVE-2026-59243, which added signature verification but omitted issuer and audience checks.

Critical Impact
Any attacker with the ability to create an Azure AD tenant can authenticate to affected Apache Airflow deployments as an arbitrary user, including administrative roles, without any prior access.

Affected Products

apache-airflow-providers-fab version 3.7.3
apache-airflow-providers-fab versions 3.7.4 through 3.8.0
Airflow deployments using the FAB auth manager with Azure AD configured as an OAuth provider

Discovery Timeline

2026-09-08 - CVE-2026-75156 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75156

Vulnerability Analysis

The FAB provider integrates Azure AD as an OAuth 2.0 identity provider for Airflow's web UI. During login, the provider receives an id_token from Azure AD and verifies its signature using keys fetched from Microsoft's multi-tenant JWKS endpoint. That endpoint returns valid signing keys for every Azure tenant, not just the tenant the operator intends to trust.

Because the provider does not check the iss (issuer) or aud (audience) claims after signature verification, any token signed by Microsoft with any tenant identifier is accepted. The FAB provider then reads the upn, email, and role claims directly from the attacker-controlled token to establish the Airflow session. This maps to [CWE-346: Origin Validation Error].

The fix for CVE-2026-59243 was incomplete. That patch introduced signature verification but did not add tenant scoping, so 3.7.3 — the release containing the earlier fix — remains vulnerable.

Root Cause

The root cause is missing validation of the iss and aud claims in the OAuth callback handler. The provider trusts signature verification alone as proof of token authenticity, ignoring that Microsoft's multi-tenant JWKS covers the entire Azure AD ecosystem rather than a single trusted tenant.

Attack Vector

An attacker registers a free Azure AD tenant and creates an application registration. They mint an id_token for a user in their own tenant with a chosen upn value matching a target Airflow account, or with role claims that grant administrative privileges. They then submit that token to the target Airflow instance's OAuth callback. Signature verification succeeds because the token was signed by Microsoft, and the FAB provider provisions a session for the attacker-supplied identity.

Refer to the GitHub Pull Request #71735 and the Apache Mailing List Thread for technical details of the fix.

Detection Methods for CVE-2026-75156

Indicators of Compromise

OAuth callback events in Airflow web server logs containing id_tokens with iss claims referencing unfamiliar Azure tenant identifiers.
New Airflow user accounts created through OAuth login with usernames or role assignments that do not match provisioned identities.
DAG execution, connection edits, or variable changes performed by user sessions established shortly after an anomalous OAuth login.

Detection Strategies

Parse Airflow web server access logs for /oauth-authorized/azure callbacks and extract the iss claim from the associated JWT for comparison against the approved tenant identifier.
Alert on any Airflow login event where the aud claim does not equal the application ID configured for the deployment.
Correlate first-seen Azure AD oid (object identifier) values in Airflow authentication events with expected user directory entries.

Monitoring Recommendations

Enable verbose OAuth logging in the FAB auth manager and forward events to a centralized log platform.
Monitor for privilege changes and new admin role assignments in the Airflow ab_user_role table.
Track DAG execution patterns for unusual activity following authentication events from previously unseen upn values.

How to Mitigate CVE-2026-75156

Immediate Actions Required

Upgrade apache-airflow-providers-fab to version 3.8.1 or later on every scheduler, worker, and web server node.
Rotate any Azure AD application client secrets and audit the Airflow user table for accounts created since deploying 3.7.3.
Review Airflow audit logs for DAG code changes, connection modifications, and variable edits performed since the affected version was installed.

Patch Information

The fix is included in apache-airflow-providers-fab version 3.8.1. The patch adds explicit validation of the iss and aud claims in the Azure AD OAuth flow. Operators who previously applied the CVE-2026-59243 fix must still upgrade, since 3.7.3 — the release that shipped that earlier fix — is the first version in the affected range. See GitHub Pull Request #71735 for the code change.

Workarounds

Temporarily disable the Azure AD OAuth provider in the FAB auth manager configuration and require an alternate authentication method until the upgrade is applied.
Place the Airflow web UI behind a network gateway or reverse proxy that enforces IP allow-listing to block anonymous access to the OAuth callback endpoint.
If Azure AD login must remain enabled, front the callback with a reverse proxy that validates the iss claim against the approved tenant before forwarding the request.

bash

# Upgrade the FAB provider to the fixed release
pip install --upgrade 'apache-airflow-providers-fab>=3.8.1'

# Verify installed version
pip show apache-airflow-providers-fab | grep -i version