apache-airflow-providers-fab

3 results · Feed

• Medium 5.3
  CVE-2026-46745

  Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token

  Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade …

  Apache Software Foundation Apache Airflow FAB provider apache-airflow-providers-fab PyPI
  May 25, 2026
• High 8.1
  CVE-2024-45033

  Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

  Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insuff…

  Apache Software Foundation Apache Airflow FAB provider airflow apache-airflow-providers-fab Wolfi PyPI
  Jan 8, 2025
• Critical 9.8
  CVE-2024-42447

  Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow

  Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from loggin…

  Apache Software Foundation Apache Airflow Providers FAB apache-airflow airflow Wolfi PyPI
  Aug 5, 2024