CVE-2026-46745

Published: May 25, 2026Modified: Jul 23, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Affected (1)

Products: Apache: Apache Airflow Providers Fab

1 product

Apache Airflow Providers Fab

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Apache Airflow Providers Fab	Before 3.6.4

Related CWEs

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

References (3)

https://github.com/apache/airflow/pull/66417

Source: security@apache.org

Issue TrackingPatch

https://lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/24/10

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.