CVE-2026-59243
Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
CVE-2026-59243: Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults…
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when Apache publishes the next one.
VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2026-59243 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- CVSS base score
- 9.8 (Apache)
- Weakness
- CWE-347
- Fixed releases
- Apache: 3.7.3
- Vendor advisories
- 2 from Apache
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-59243; bulletin-wide values are not repeated here.
Is CVE-2026-59243 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-59243 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-59243?
Upgrade to a fixed release named by the vendor:
- Apache: 3.7.3
- Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`. (Apache)
Vendor advisory comparison
Apache
2 advisories- Advisory severityCritical9.1
Critical [CVE-2026-59243 +1] Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
CVE-2026-75156Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token`…
- Affected products in this advisory
- Apache Airflow FAB
- Source-reported affected versions
- Apache Airflow FAB provider 3.7.3 before 3.8.1
- Source-reported fixed versions
- 3.8.1
- Mitigation guidance
- Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range.
- Upgrade to apache-airflow-providers-fab `3.8.1` or later.
- Advisory severityCritical9.8
Critical [CVE-2026-59243] Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
CVE-2026-59243Source published Source updated
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`. Affected product named by the advisory: Apache Airflow FAB provider.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Apache Airflow FAB provider before 3.7.3
- Source-reported fixed versions
- 3.7.3
- Mitigation guidance
- Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.
More Apache advisories
- CVE-2026-86466Sep 16, 2026Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not
- CVE-2026-82310Sep 16, 2026Apache Airflow FAB provider: deactivating a user account does not stop tokens issued
- CVE-2026-86462Sep 16, 2026Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH
- CVE-2026-82311Sep 16, 2026Apache Airflow FAB provider: resetting a user's password does not delete that user's
- CVE-2026-59245Jul 13, 2026Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
Follow CVE-2026-59243 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.