CVE-2026-25604: Apache Airflow AWS Auth Manager Host Header Injection Leading to SAML Authentication Bypass
Summary
CVE-2026-25604: Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass. Affects apache-airflow-providers-amazon versions < 9.22.0. Fixed in 9.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. The AWS Auth Manager is a component that facilitates authentication with AWS services. It allows users to manage access controls and permissions for different AWS resources. However, a vulnerability has been identified in the AWS Auth Manager that could potentially compromise the security of instances by allowing unauthorized access through SAML authentication.
Vulnerability Detail
The vulnerability arises from the AWS Auth Manager's reliance on the SAML authentication origin provided by the client without verifying it against the actual instance URL. This oversight allows an attacker to reuse SAML responses from different instances, potentially bypassing access controls and gaining unauthorized access to sensitive resources. The issue is classified under CWE-346, indicating improper handling of authentication mechanisms.
How To Fix
Minimum fixed version
9.22.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow-providers-amazon==9.22.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the SAML responses are validated against the expected instance URL before processing them. This can be done by implementing additional checks in the authentication flow to verify the origin of the SAML response.
Conclusion
In summary, CVE-2026-25604 is a significant vulnerability in the Apache Airflow AWS Auth Manager that allows for SAML authentication bypass due to improper handling of the SAML response origin. Upgrading to the patched version is crucial to secure your application against potential unauthorized access.
See every vulnerability recorded for apache-airflow-providers-amazon →
FAQ
The impact includes potential unauthorized access to AWS resources by exploiting SAML authentication, leading to data breaches or unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 5.4, indicating a moderate level of severity.
Yes, you should upgrade to version 9.22.0 or later of the 'apache-airflow-providers-amazon' package to mitigate this vulnerability.
Vulert monitors and alerts in real-time for open-source vulnerabilities in software by analyzing the Pipfile.lock, helping developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow-providers-amazon.
