CVE-2026-75156
CVE-2026-75156 is covered by the Apache CVE-2026-75156 security bulletin. Not in the CISA KEV catalog. Critical advisory severity. 2 advisories from Apache.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when Apache publishes the next one.
VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2026-75156 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- Vendor advisories
- 2 from Apache
- VulniPulse record
- Published · Updated
Is CVE-2026-75156 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-75156 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-75156?
This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.
Vendor advisory comparison
Apache
2 advisories- Advisory severityCritical9.1
Critical [CVE-2026-59243 +1] Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
CVE-2026-75156Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token`…
- Affected products in this advisory
- Apache Airflow FAB
- Source-reported affected versions
- Apache Airflow FAB provider 3.7.3 before 3.8.1
- Source-reported fixed versions
- 3.8.1
- Mitigation guidance
- Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range.
- Upgrade to apache-airflow-providers-fab `3.8.1` or later.
- Advisory severityHigh8.1
High [CVE-2026-75156 +1] Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts
CVE-2026-86466Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications; the attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here. Deployments that applied the CVE-2026-75156 fix and…
- Related products — impact not confirmed
- Apache Airflow FAB
- Source-reported affected versions
- Apache Airflow FAB provider before 3.9.0
- Source-reported fixed versions
- 3.9.0
- Mitigation guidance
- Deployments that applied the CVE-2026-75156 fix and use Authentik must also upgrade for this one.
- Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.
More Apache advisories
- CVE-2026-86466Sep 16, 2026Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not
- CVE-2026-82310Sep 16, 2026Apache Airflow FAB provider: deactivating a user account does not stop tokens issued
- CVE-2026-86462Sep 16, 2026Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH
- CVE-2026-82311Sep 16, 2026Apache Airflow FAB provider: resetting a user's password does not delete that user's
- CVE-2026-59245Jul 13, 2026Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
Follow CVE-2026-75156 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Apache CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.