CVE-2026-59243 in Airflow FAB Provider
Summary
by MITRE • 07/29/2026
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in question involves a critical security flaw within the FAB auth manager's Azure AD OAuth implementation that fundamentally undermines the authentication process. This issue stems from a default configuration parameter that disables signature verification during ID token processing, creating an avenue for attackers to bypass authentication mechanisms entirely. The flaw specifically affects deployments using the Azure AD OAuth login path with the default settings, while the Authentik path was already correctly configured with signature verification enabled by default.
The technical implementation of this vulnerability exploits a well-known weakness in OAuth 2.0 and OpenID Connect protocols where the ID token signature verification is disabled through the `verify_signature=False` parameter. When an attacker crafts a forged ID token with the `alg:none` algorithm, they can manipulate the token contents to impersonate any user account, including those with administrative privileges. This represents a classic case of insufficient validation of cryptographic signatures, which falls squarely under CWE-347, or "Improper Verification of Cryptographic Signature." The vulnerability essentially allows for arbitrary user impersonation by leveraging the trust model that should validate token authenticity through digital signatures.
The operational impact of this vulnerability is severe and far-reaching within Apache Airflow environments that utilize the affected FAB auth manager. An attacker who can intercept or manipulate the OAuth callback flow can gain unauthorized access to the system with whatever privileges are assigned to the forged user account, potentially including full administrative control. This authentication bypass allows for privilege escalation attacks where attackers can assume the identity of any user within the system, including those with elevated permissions. The attack vector requires minimal sophistication since it only necessitates crafting a valid-looking ID token rather than exploiting complex cryptographic weaknesses or system vulnerabilities.
The remediation strategy involves upgrading to apache-airflow-providers-fab version 3.7.3, which corrects the default behavior by enabling signature verification through `verify_signature=True`. This update aligns the Azure AD OAuth implementation with industry best practices and security standards that mandate cryptographic signature validation as a fundamental requirement for secure authentication flows. Organizations should also conduct immediate security audits to verify all deployments are using the patched version and review their authentication configurations to ensure no other similar misconfigurations exist. The fix addresses the core issue by enforcing proper token validation procedures that align with the OAuth 2.0 and OpenID Connect specifications, specifically mitigating the attack pattern described in the ATT&CK framework under privilege escalation techniques where authentication bypass is achieved through manipulation of authentication tokens.