OAuth Validation Flaw in Apache Airflow FAB Provider by Authentik

CVE-2026-86466

What is CVE-2026-86466?

A security issue has been identified in the Apache Airflow FAB provider with the Authentik OAuth integration. The vulnerability arises from the absence of validation for issuer and audience claims in the ID tokens accepted by the FAB authentication manager. This oversight allows an attacker to leverage a valid token, generated for another client application by the same Authentik instance, granting unauthorized access to the Airflow system as the named user. Users must ensure they upgrade to version 3.9.0 or later of the Apache Airflow FAB provider to mitigate this risk effectively.

References