CVE-2026-86466 Overview
CVE-2026-86466 affects the Apache Airflow FAB provider when configured with the Authentik OAuth authentication path. The FAB auth manager does not validate the iss (issuer) or aud (audience) claims of the id_token it accepts. An attacker who holds a token minted by the same Authentik identity provider for a different client application can present it to Airflow. Airflow authenticates the attacker as the user named in the token because the audience claim is never checked. This weakness is classified under [CWE-346: Origin Validation Error]. The related CVE-2026-75156 fixed the same flaw on the Azure AD path in the same file, but the Authentik path was left unchanged and is now corrected in apache-airflow-providers-fab version 3.9.0.
Critical Impact
Any valid Authentik id_token issued to another application on the same Authentik instance can be replayed against Airflow to impersonate the named user.
Affected Products
- Apache Airflow FAB provider (apache-airflow-providers-fab) versions prior to 3.9.0
- Deployments using the FAB auth manager with Authentik OAuth
- Environments where the same Authentik instance serves Airflow and at least one other client application
Discovery Timeline
- 2026-09-16 - CVE-2026-86466 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-86466
Vulnerability Analysis
The FAB auth manager implements OAuth-based single sign-on through several identity provider paths. The Authentik path accepts an OpenID Connect id_token from the browser and trusts the identity encoded within it. The implementation validates the token signature but does not enforce the iss and aud claims. Because those claims are the only cryptographic binding between a token and its intended relying party, omitting them collapses the trust boundary between distinct client applications sharing one Authentik tenant. An attacker who obtains an id_token from any peer application registered in that Authentik instance can present it to Airflow and be logged in as the subject named in the token.
Root Cause
The root cause is an origin validation error [CWE-346] in the Authentik OAuth handler within the FAB auth manager. The code path deserializes the id_token, extracts the user identity claim, and creates the Airflow session without confirming that the token was issued for the Airflow client. CVE-2026-75156 addressed the identical omission on the Azure AD path in the same file, but the Authentik branch was not updated at that time.
Attack Vector
Exploitation requires an attacker who already holds a valid Authentik-issued id_token for any application other than Airflow that shares the same Authentik instance. The attacker submits that token to the Airflow FAB auth manager Authentik OAuth callback. Because Airflow does not verify that the aud claim matches its own client ID, or that the iss claim matches the expected Authentik issuer URL, the token is accepted. The attacker gains authenticated access to Airflow as the user named in the sub claim. No user interaction with the victim account is required. For technical details of the fix, see the Apache Airflow Pull Request 72645 and the Apache mailing list announcement.
Detection Methods for CVE-2026-86466
Indicators of Compromise
- Airflow authentication events for users who never signed in through the Airflow-branded Authentik consent screen.
- Authentik audit logs showing id_token issuance for a non-Airflow client immediately followed by Airflow session creation for the same subject.
- Session cookies in Airflow tied to identities whose aud claim (if logged) references another registered client.
Detection Strategies
- Enable verbose logging in the FAB auth manager to capture the raw id_token claims presented at login and alert on any aud value that does not match the Airflow client ID.
- Correlate Authentik token issuance events with Airflow login events by sub claim and flag mismatches between the issuing client and the consuming application.
- Review Airflow user-role assignments for accounts created or elevated by SSO flows within the vulnerable window.
Monitoring Recommendations
- Ship FAB auth manager logs and Authentik audit logs to a centralized SIEM and build a correlation rule keyed on aud, iss, and sub.
- Alert on Airflow logins from users who have no prior Airflow activity but recent activity on other Authentik-integrated applications.
- Monitor for privileged Airflow operations (DAG modification, connection edits, variable reads) that follow SSO logins during the exposure window.
How to Mitigate CVE-2026-86466
Immediate Actions Required
- Upgrade apache-airflow-providers-fab to version 3.9.0 or later on every Airflow deployment using the FAB auth manager with Authentik.
- If the CVE-2026-75156 fix was previously applied on an Authentik deployment, treat that patch as incomplete and upgrade now.
- Rotate the Authentik OAuth client secret used by Airflow and invalidate active Airflow sessions after upgrading.
- Audit Airflow user activity for the exposure window and revoke any suspicious sessions or role assignments.
Patch Information
The fix is available in apache-airflow-providers-fab version 3.9.0. The patch adds iss and aud claim validation to the Authentik OAuth path, aligning it with the Azure AD fix delivered in CVE-2026-75156. See the GitHub Pull Request 72645 and the related CVE-2026-75156 record for context.
Workarounds
- Isolate Airflow on a dedicated Authentik instance that serves no other client applications until the upgrade is complete.
- Temporarily switch the FAB auth manager to a non-Authentik authentication backend, such as database or LDAP authentication.
- Restrict network access to the Airflow web UI to trusted networks or a VPN while the patch is being deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
