CVE-2026-46745: Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-fabto a version that resolves this vulnerability.Fixed in 3.6.4Patch CVE-2026-46745 - Configuration
If an upgrade to apache-airflow-providers-fab 3.6.4 or later is not immediately possible, disable LDAP authentication until the provider can be updated.
Apache Airflow FAB Auth Manager (FAB provider LDAP authentication) LDAP authentication = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46745?
CVE-2026-46745 has a risk score of 28, indicating a significant vulnerability in Apache Airflow's FAB Auth Manager.
How do I fix CVE-2026-46745?
To mitigate CVE-2026-46745, upgrade to apache-airflow-providers-fab version 3.6.4 or later.
What types of attacks does CVE-2026-46745 allow?
CVE-2026-46745 allows unauthenticated attackers to exfiltrate directory data or potentially bypass authentication.
Which component of Apache Airflow is affected by CVE-2026-46745?
CVE-2026-46745 affects the FAB Auth Manager component of Apache Airflow.
What should I do if an immediate upgrade is not possible for CVE-2026-46745?
If an immediate upgrade is not feasible, disable LDAP authentication in the affected system.