A critical authentication bypass vulnerability in the Apache Airflow FAB provider allows attackers to impersonate authorized users by reusing OAuth tokens minted for other applications.

This vulnerability involves an origin validation error (CWE-346) within the Authentik OAuth path of the FAB auth manager. An authenticated user of a different application sharing the same Authentik instance can provide their token to Airflow, which fails to verify the intended audience, resulting in unauthorized access as the targeted user.

Successful exploitation allows an attacker to gain unauthorized access to the Airflow environment with the privileges of an existing user. Given the CVSS score of 8.1, this is a high-severity issue that could lead to full compromise of data workflows, unauthorized execution of tasks, or manipulation of sensitive pipeline configurations.

Immediate Action: Upgrade the apache-airflow-providers-fab package to version 3.9.0 or later to implement required audience and issuer claim validation.

Proactive Monitoring: Review authentication logs for suspicious login patterns or unexpected user sessions that originate from tokens intended for other integrated services.

Compensating Controls: If immediate patching is not feasible, restrict access to the Airflow web interface via network-level controls (such as VPN requirements) or disable Authentik OAuth integration temporarily.

Public Exploit Available: Unknown

This vulnerability poses a significant risk to organizations using shared identity providers across multiple applications. Administrators must prioritize the upgrade to version 3.9.0 immediately to prevent unauthorized account impersonation and protect the integrity of their data pipelines.