Cyber ·
CVE-2026-86467: CSRF in the SAML login of the AWS authentication manager of Apache Airflow
CSRF flaw in the SAML login flow of the AWS authentication manager in the Apache Airflow Amazon provider, rated moderate, fixed in version 9.38.0.
On October 19, 2026, the oss-sec list published advisory CVE-2026-86467 about the Apache Airflow Amazon provider. According to the text, the SAML login flow of the AWS authentication manager does not bind the authentication response to the browser that started it. The login handler discards the AuthnRequest identifier, and the callback validates the assertion without requiring a matching InResponseTo. As a result, an unauthenticated attacker who can get a victim to load a crafted page may cause the victim to be logged into the attacker's account. The severity is rated moderate. Versions of the provider before 9.38.0 are affected. To check whether your environment is exposed, confirm the installed version of the Amazon provider package and compare it with the affected versions listed in the original advisory, which you should consult directly on the oss-sec list. The indicated fix is to update to version 9.38.0 or later. Rota Nacional does not patch your orchestration packages; this is a dependency update and a review of your authentication configuration. If you use AI to study the advisory or draft a remediation plan, do not paste tokens, session cookies, credentials, logs with user identifiers, or email addresses. Remove that data first. The platform detects personal data and applies your organization's policy, but this does not replace applying the patch.