CVE-2026-86467

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.38.0

Description The AWS auth manager's SAML login flow fails to bind the authentication response to the browser that initiated the request. The login handler discards the AuthnRequest ID, and the callback validates the assertion without requiring a matching InResponseTo. This allows an unauthenticated attacker to trick a victim into loading a page, completing a SAML login in the victim's browser using the attacker's own assertion. Consequently, the victim is silently logged into the attacker's Airflow account, and any subsequent actions performed by the victim occur within a session controlled by the attacker.

Recommendations Upgrade to version 9.38.0.