A critical authentication bypass vulnerability in the Apache Airflow FAB provider allows unauthenticated attackers to gain full administrative control over the application.

This vulnerability involves the improper verification of cryptographic signatures (CWE-347) within the FAB auth manager. An unauthenticated attacker can present a forged ID token to the OAuth callback, resulting in successful authentication as an arbitrary user, including those with administrative privileges.

The potential for unauthorized administrative access poses a catastrophic risk to organizational data and system integrity. Because this flaw allows for full account takeover without valid credentials, attackers could exfiltrate sensitive workflow data, modify system configurations, or deploy malicious tasks. The CVSS score of 9.8 reflects the high probability of exploitation and the severe impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade to apache-airflow-providers-fab version 3.7.3 or later, which correctly enforces ID token signature verification.

Proactive Monitoring: Review authentication logs for unusual login patterns, specifically focusing on OAuth callbacks that originate from unexpected sources or contain suspicious token signatures.

Compensating Controls: Implement strict network access controls to limit exposure of the Airflow management interface to trusted internal networks only, reducing the attack surface for remote exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the critical severity and the availability of a public proof-of-concept, organizations must prioritize upgrading the Apache Airflow FAB provider. Failure to patch allows trivial, unauthenticated access to the entire Airflow environment, which should be mitigated immediately to prevent potential compromise.