CVE-2026-46745 Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token

What is CVE-2026-46745?

CVE-2026-46745 is a medium-severity vulnerability in Apache Airflow FAB provider, published on 25 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Weakness: CWE-90

Which versions are affected by CVE-2026-46745?

3 open source packages ship an affected version, including apache-airflow-providers-fab. It affects 1 product.

Products include Apache Apache-Airflow-Providers-Fab.

How do I fix CVE-2026-46745?

Upgrade apache-airflow-providers-fab to 3.6.4 or later.

Is CVE-2026-46745 being exploited?

There is no known exploitation of CVE-2026-46745 in the wild and no public exploit code.

Other vulnerabilities in Apache Airflow FAB provider

• CVE-2026-82311 Security feature bypass in Apache Airflow FAB provider Critical 9.8
• CVE-2026-59243 Auth bypass in Apache Airflow FAB provider Critical 9.8
• CVE-2024-42447 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow Critical 9.8
• CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions Critical 9.1
• CVE-2026-75156 Auth bypass in Apache Airflow FAB provider Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-GI56034, ECHO-2db4-4278-75a2, GHSA-g283-w6fp-c4fc, MINI-3jp3-pjr8-gr6f, MINI-8mw4-pq6g-h2mr, PYSEC-2026-2366.