CVE-2026-46745: Apache Airflow FAB _search_ldap LDAP Filter Injection Reachable from /auth/token Login Endpoint

Apache Airflow FAB _search_ldap LDAP Filter Injection Reachable from /auth/token Login Endpoint

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

CVE IDCVE-2026-46745

CVSS v3.15.3 Medium

VendorApache Software Foundation

CWECWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

DisclosedMay 25, 2026

StatusPublished

01/Description

What this actually is.

Technical background, root cause, and affected surface.

Vendor: Apache Software Foundation
Product: Apache Airflow FAB provider
Severity: Medium
CVSS Score: 5.3
Status: Published
CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

02/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2026-46745

nvd.nist.gov/vuln/detail/CVE-2026-46745 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

Apache Airflow FAB _search_ldap LDAP Filter Injection Reachable from /auth/token Login Endpoint

What this actually is.

Cite, verify, go deeper.

NVD — CVE-2026-46745

Securin VI — Full Technical Analysis

Let Securin level up your security posture.