Authentication Bypass Vulnerability in Apache Airflow FAB Auth Manager

CVE-2026-59243

What is CVE-2026-59243?

A security vulnerability exists in the Apache Airflow FAB auth manager's OAuth login, where the default setting of verify_signature=False allows attackers to exploit the system. By presenting a forged or unsigned ID token, attackers can bypass authentication and gain unauthorized access as any user, including those with admin privileges. This flaw specifically impacts configurations using the Azure AD OAuth path, and it is crucial for users to upgrade to version 3.7.3 or later to enable proper signature verification.

References