CVE-2026-46745

5.3 Moyenne

Publiée le 25/05/2026 à 13:16 · Modifiée le 23/07/2026 à 19:10 · Analysée par le NVD · Source : security@apache.org

Description

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Traduire en français

Produits concernés

Apache Software Foundation Apache Airflow FAB provider
Apache apache-airflow-providers-fab

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-90

Références

https://github.com/apache/airflow/pull/66417 Issue TrackingPatch
https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/24/10 Mailing ListThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories