CVE-2026-75156

Name of the Vulnerable Software and Affected Versions Apache Airflow FAB provider versions 3.7.3 through 3.8.0

Description An issue exists during OAuth login when the FAB auth manager is configured with Azure AD as an OAuth provider. The software fails to validate the issuer or audience of Azure AD id tokens. Since signing keys are retrieved from a multi-tenant JWKS (JSON Web Key Set) endpoint, an id token generated in any Azure tenant, including those created by an attacker, can pass signature verification. This allows an attacker to provide a controlled token to manipulate username and role assignments, enabling unauthorized authentication to the Airflow UI.

Recommendations Upgrade Apache Airflow FAB provider versions 3.7.3 through 3.8.0 to version 3.8.1 or later.