Improper Verification of Cryptographic Signature Affecting apache-airflow-providers-fab package, versions [, 3.7.3)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-APACHEAIRFLOWPROVIDERSFAB-18391446
- published29 Jul 2026
- disclosed29 Jul 2026
- creditMalHyuk
Introduced: 29 Jul 2026
CVE-2026-59243 (opens in a new tab)How to fix?
Upgrade apache-airflow-providers-fab to version 3.7.3 or higher.
Overview
apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verify_signature parameter in the Azure AD OAuth login defaulting to False, which disables JWT signature verification. An attacker can gain unauthorized access as any user, including those with administrative privileges, by presenting a forged or unsigned ID token to the OAuth callback.
Note: This is only exploitable if the FAB auth manager is configured with the Azure AD OAuth login path using its default settings.