CVE-2026-25604Medium· 5.4▾ TwilightPoC availableIn AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access co…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo
0.4% → 0.5%
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.
You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
apache-airflow-providers-amazon >= 8.0.0, < 9.22.0Upgrade past the affected range:
apache-airflow-providers-amazon 9.22.0Affected packages:
apache-airflow-providers-amazon < 9.22.0Patched in:
apache-airflow-providers-amazon 9.22.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-25956High· 7.5Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information
CVE-2026-68872Medium· 6.5The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed
CVE-2026-86467NoneApache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
CVE-2026-108372High· 7.1LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
CVE-2026-81930Medium· 6.3Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs
CVE-2026-81914Medium· 4.3Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them