CVE-2026-46745

5.3 mediumEPSS 0.6%

Medium (5.3) in apache apache-airflow-providers-fab. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in apache-airflow-providers-fab 3.6.4.

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-90
Published: 2026-05-25
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

Affected

apache:apache-airflow-providers-fab

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-g283-w6fp-c4fc	PyPI	apache-airflow-providers-fab	<3.6.4	3.6.4
PYSEC-2026-2366	PyPI	apache-airflow-providers-fab	<3.6.4	3.6.4

References

Check your stack JSON