CVE-2026-86467 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Airflow deployments using the AWS auth manager with SAML authentication should assess exposure and prioritize upgrading to version 9.38.0. They should also verify SAML authentication configuration and user session management in their Airflow deployments. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and

Why it matters

Defenders should care about CVE-2026-86467 because it allows unauthenticated attackers to log victims into the attacker's Airflow account via SAML login CSRF, potentially leading to lateral movement within Airflow deployments. Affected deployments using the AWS auth manager with SAML authentication should prioritize upgrading to version 9.38.0 and verify SAML authentication configuration and user session management.

• Silent login of victims into the attacker's Airflow account
• Subsequent work by victims lands in a session controlled by the attacker
• Potential for lateral movement within Airflow deployments
• Verification of SAML authentication configuration and user session management

Technical summary

The AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it, allowing an unauthenticated attacker to complete a SAML login in the victim's browser using the attacker's own assertion. This can be exploited by causing a victim to load a page controlled by the attacker, potentially leading to lateral movement within Airflow deployments. The issue affects deployments using the AWS auth manager with SAML authentication. Users are recommended to upgrade to version 9.38.0 to mitigate this issue.

Defensive priority

Defenders should prioritize upgrading to version 9.38.0 and assess exposure in Airflow deployments using AWS auth manager with SAML authentication.

Recommended defensive actions

• Upgrade to version 9.38.0
• Assess exposure in Airflow deployments using AWS auth manager with SAML authentication
• Verify SAML authentication configuration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and recommended actions. The vulnerability is caused by the AWS auth manager's SAML login flow not binding the authentication response to the browser that began it. Evidence is limited to the information provided in the CVE record and source item. Defenders should verify the SAML authentication configuration and user session management in their Airflow deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.