LDAP Filter Injection Vulnerability Affecting Apache Airflow FAB Auth Manager
CVE-2026-46745

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Airflow Fab Provider
Vendor
CVE Published:
25 May 2026

What is CVE-2026-46745?

The Apache Airflow FAB Auth Manager is susceptible to an LDAP filter injection vulnerability, which can be exploited by unauthenticated attackers to access sensitive directory data or circumvent authentication mechanisms. To mitigate this risk, users are advised to upgrade to apache-airflow-providers-fab version 3.6.4 or later. If immediate updating is unfeasible, it is recommended to disable LDAP authentication until the system can be secured with the latest provider version.

Affected Version(s)

Apache Airflow FAB provider 0 < 3.6.4

References

https://github.com/apache/airflow/pull/66417
patch
https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55zt...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Venkatraman Kumar (r3dw0lfsec), Securin
orbisai0security (automated scanner — Orbis Security AI)
.