Security Flaw in Apache Airflow Amazon Provider Reveals SAML Authentication Weakness

CVE-2026-86467

What is CVE-2026-86467?

An issue in Apache Airflow's AWS auth manager allows an unauthenticated attacker to exploit the SAML login flow. The vulnerability arises because the authentication response is not properly bound to the initiating browser, enabling attackers to hijack user sessions. When victims visit a page controlled by the attacker, their browser can be manipulated to execute a SAML login using the attacker's assertion, leading to unauthorized access to the attacker's Airflow account. This flaw specifically impacts users leveraging SAML authentication with the AWS auth manager, necessitating an upgrade to version 9.38.0 or later to safeguard against potential exploits.

References