CVE-2026-25604: Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.
You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflow-providers-amazonto a version that resolves this vulnerability.Fixed in 9.22.0 - Upgrade
Upgrade
Apache Airflow AWS Auth Manager (provider)to a version that resolves this vulnerability.Fixed in 9.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25604?
CVE-2026-25604 is considered a high severity vulnerability due to the potential for unauthorized access to AWS instances.
How do I fix CVE-2026-25604?
To fix CVE-2026-25604, ensure that the SAML authentication origin is verified against the actual instance URL.
Which versions of Apache Airflow are affected by CVE-2026-25604?
CVE-2026-25604 affects versions of Apache Airflow AWS Auth Manager up to version 9.22.0.
What type of attack does CVE-2026-25604 enable?
CVE-2026-25604 enables host header injection that can lead to SAML authentication bypass.
Is there an official patch available for CVE-2026-25604?
Yes, an official patch for CVE-2026-25604 has been made available in subsequent releases of the affected software.