CVE-2026-86466 Apache Software Foundation CVE debrief

Who should care

Deployments using the FAB auth manager with Authentik OAuth, security teams, and administrators responsible for Apache Airflow. These teams should assess exposure, verify authentication mechanisms, and upgrade to version 3.9.0 or later. They should also review compensating controls for exposed systems and track exceptions.

Why it matters

CVE-2026-86466 allows authentication bypass in Apache Airflow FAB provider, impacting deployments using FAB auth manager with Authentik OAuth. Security teams and administrators should assess exposure, verify authentication mechanisms, and upgrade to version 3.9.0 or later.

• Authentication bypass using a valid token from another client application
• Potential unauthorized access to Airflow instances
• Need to verify authentication mechanisms
• Upgrade priority to version 3.9.0 or later

Technical summary

The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts, allowing an attacker to authenticate as a user with a valid token from another client application. This affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications. The attacker needs a valid token for any of those other applications, not for Airflow. CVE-2026-75156 corrected the same missing validation on the Azure AD path in this file; the Authentik path was left unchanged and is fixed here.

Defensive priority

Upgrade to version 3.9.0 or later, assess exposure in FAB auth manager with Authentik OAuth

Recommended defensive actions

• Upgrade to version 3.9.0 or later
• Assess exposure in FAB auth manager with Authentik OAuth
• Verify authentication mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which affects deployments using the FAB auth manager with Authentik OAuth. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. This allows an attacker to authenticate as a user with a valid token from another client application. The issue is fixed in version 3.9.0 or later of apache-airflow-providers-fab.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.