Medium severity · published Mar 9, 2026
CVE-2026-25604
Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.
This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.
You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Airflow Providers Amazon · Apache Software Foundation
8.0.0 before 9.22.0 · source: vendor
AP
Apache-airflow-providers-amazon · Apache
8.0.0 before 9.22.0 · source: NVD
Affected product
AA
Apache Airflow Providers Amazon
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25604
Issue Tracking
https://github.com/apache/airflow/pull/61368
Mailing List
https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77
Mailing List
http://www.openwall.com/lists/oss-security/2026/03/09/6