CVE-2026-59243 Auth bypass in Apache Airflow FAB provider

Critical 9.8 Published 29 Jul 2026 Updated 16 Sep 2026

Attackers can bypass authentication and log in as arbitrary users, including admins, due to disabled JWT signature verification in Azure AD OAuth.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59243?

CVE-2026-59243 is a critical authentication bypass vulnerability in Apache Airflow FAB provider, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

Weakness: CWE-347

Which versions are affected by CVE-2026-59243?

It affects 1 product.

Products include Apache Apache-Airflow-Providers-Fab.

How do I fix CVE-2026-59243?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-59243 being exploited?

There is no known exploitation of CVE-2026-59243 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

Also known as CLEANSTART-2026-LK77768, GHSA-q5r3-w69r-hrfw.