CVE-2026-75156 Apache Software Foundation CVE debrief

Who should care

Airflow administrators and users who have Azure AD configured as an OAuth provider should assess exposure and upgrade to a fixed version. This includes reviewing current configurations, verifying authentication mechanisms, and ensuring that all necessary security measures are in place to prevent unauthorized access.

Why it matters

CVE-2026-75156 allows attackers to authenticate to Airflow UI via Azure AD OAuth without prior access. Airflow administrators and users with Azure AD OAuth configured should verify exposure and upgrade to apache-airflow-providers-fab 3.8.1 or later.

• Potential unauthorized authentication to Airflow UI
• Possible elevation of privileges for attackers
• Need for verification of authentication and authorization mechanisms
• Priority on upgrading to a fixed version

Technical summary

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD id_tokens during OAuth login. This allows an attacker to authenticate to the Airflow UI with no prior access to the deployment by registering an Azure tenant and minting an id_token. The fix involves upgrading to apache-airflow-providers-fab 3.8.1 or later, which includes the necessary validation checks. Operators who already applied the CVE-2026-59243 fix are still affected and must upgrade again. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

High

Recommended defensive actions

• Upgrade to apache-airflow-providers-fab 3.8.1 or later
• Review and update Azure AD OAuth provider configurations
• Verify authentication and authorization mechanisms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Apache Airflow FAB provider versions 3.7.3 through 3.8.0. The issue is related to the lack of validation of the issuer or audience of Azure AD id_tokens during OAuth login.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.