CVE-2026-46745

MediumCVSS 5.3

Published: 25/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

44th percentile - higher than 44% of all known CVEs

Summary

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication.

Risk Assessment

The organization risks unauthorized system access and leakage of LDAP directory data, potentially leading to security breaches.

Recommendation

Upgrade apache-airflow-providers-fab to version 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Other vulnerabilities in Apache Airflow FAB Auth Manager

CVE-2026-59245High
In Apache Airflow FAB auth manager, a DAG named `DAGs` collides with the global all-DAGs permission resource name. A user granted per-DAG access to that specific DAG silently receives global all-DAGs permissions, leading to privilege escalation.

Original NVD description (English source)

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.