LDAP Filter Injection Vulnerability Affecting Apache Airflow FAB Auth Manager
CVE-2026-46745

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow Fab Provider
Vendor
CVE Published:
25 May 2026

What is CVE-2026-46745?

The Apache Airflow FAB Auth Manager is susceptible to an LDAP filter injection vulnerability, which can be exploited by unauthenticated attackers to access sensitive directory data or circumvent authentication mechanisms. To mitigate this risk, users are advised to upgrade to apache-airflow-providers-fab version 3.6.4 or later. If immediate updating is unfeasible, it is recommended to disable LDAP authentication until the system can be secured with the latest provider version.

Affected Version(s)

Apache Airflow FAB provider 0 < 3.6.4

References

https://github.com/apache/airflow/pull/66417
patch
https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55zt...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Venkatraman Kumar (r3dw0lfsec), Securin
orbisai0security (automated scanner — Orbis Security AI)
.