VulnSocial

CVE-2026-59243Patch(apache / apache-airflow-providers-fab)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch apache apache-airflow-providers-fab systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

apache CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-347

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • apache-airflow-providers-fab

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 4 mentions (2026-07-29); latest day: 1
  • 5 total mentions across 2 days

Affected systems

Vendors
apache
Products
apache-airflow-providers-fab

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-07-29: 4Mentions · 2026-07-30: 1PoC Mentioned / Linked · 2026-07-30: 1Exploit Tool / Code · 2026-07-30: 1Patch / Workaround · 2026-07-29: 2Technical Details · 2026-07-29: 407-2907-30
Signal classification4 categories
Patch
240.0%
Disclosure
120.0%
General
120.0%
PoC
120.0%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-07-294
Disclosure1General1Patch2
2026-07-301
PoC1
Full discourse5 posts
  • Marcell Ujlaki@UjlakiMarci
    Patch

    🟥 CVE-2026-59243 | Apache Airflow FAB provider, CVSS: 9.8 (Critical) the vulnerability allows remote attackers to bypass authentication and gain administrative control by presenting forged or unsigned ID tokens during the Azure AD OAuth callback. deployments using the FAB auth manager with Azure AD OAuth under default configurations are vulnerable because token signature verification is improperly disabled. system administrators should upgrade to version 3.7.3 or later https://github.com/apache/airflow/pull/69374

    Post summary

    The tweet announces a critical CVE (CVE‑2026‑59243) affecting Apache Airflow’s FAB provider, details the authentication bypass via forged ID tokens, and advises users to upgrade to version 3.7.3 or newer.

    10011137
    358 followersView on X
  • Marcell Ujlaki@UjlakiMarci
    General

    CWE-347: Improper Verification of Cryptographic Signature http://cwe.mitre.org/data/definitions/347.html #EUVD: https://euvd.enisa.europa.eu/vulnerability/CVE-2026-59243 #NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59243

    Post summary

    The passage merely cites the CVE and its corresponding CWE reference, providing links to official repositories but lacking details on exploitation, patches, or proof‑of‑concepts.

    0000149
    358 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    🔓 Apache Airflow FAB provider (CVE-2026-59243, CVSS 9.8): Azure AD OAuth skips JWT signature verification by default. Attackers can present an unsigned `alg:none` token to hijack auth. Update now. #cybersecurity #ciso #cto #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-59243?utm_campaign=x https://t.co/osk8g1ZDUi

    Post summary

    The post highlights a critical Azure AD OAuth JWT verification flaw in Apache Airflow FAB, describes how unsigned `alg:none` tokens can hijack authentication, and urges immediate patching.

    00010190
    872 followersView on X
  • MalHyuk@MalHyuk_
    PoC

    CVE-2026-59243 Write-up https://github.com/MalHyuk/CVE-2026-59243

    Post summary

    The text references a GitHub write‑up for CVE-2026-59243, indicating that proof‑of‑concept code or exploitation details are likely available.

    0000081
    42 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-59243 Authentication Bypass in Apache Airflow FAB Auth Manager Azure AD OAuth Before 3.7.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-59243

    Post summary

    The text announces CVE-2026-59243, describing an authentication‑bypass flaw in Apache Airflow’s FAB Auth Manager for Azure AD OAuth prior to v3.7.3, without providing exploitation, patch, or PoC details.

    0000085
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheapache-airflow-providers-fab---

Explore more

Back to dashboardapache CVEsapache-airflow-providers-fab vulnerabilities