Vulnerability-Lookup

CVE-2026-25604 (GCVE-0-2026-25604)

Vulnerability from cvelistv5 – Published: 2026-03-09 10:39 – Updated: 2026-03-09 16:48

Title

Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

Summary

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

Severity ?

No CVSS data available.

CWE

CWE-346 - Origin Validation Error

Assigner

apache

References

URL

Tags

	https://github.com/apache/airflow/pull/61368	patch
	https://lists.apache.org/thread/spwwrsmwxod7fpttc…	vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Airflow Providers Amazon	Affected: 8.0.0 , < 9.22.0 (semver)

Credits

Sungwuk Jung

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-09T12:09:58.818Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/09/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-25604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T16:47:57.674471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T16:48:12.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-amazon",
          "product": "Apache Airflow Providers Amazon",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "9.22.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sungwuk Jung"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u0026nbsp;\u003cbr\u003eThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\u003c/p\u003eYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "medium"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-09T10:39:05.883Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/61368"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-25604",
    "datePublished": "2026-03-09T10:39:05.883Z",
    "dateReserved": "2026-02-03T09:59:31.342Z",
    "dateUpdated": "2026-03-09T16:48:12.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25604\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-03-09T11:16:06.077\",\"lastModified\":\"2026-03-10T18:58:48.887\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\\n\\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.\"},{\"lang\":\"es\",\"value\":\"En el gestor de AWS Auth, el origen de la autenticaci\u00f3n SAML se ha utilizado tal como lo proporcion\u00f3 el cliente y no se ha verificado contra la URL real de la instancia.\\nEsto permiti\u00f3 obtener acceso a diferentes instancias con controles de acceso potencialmente diferentes al reutilizar la respuesta SAML de otras instancias.\\n\\nDeber\u00eda actualizarse a la versi\u00f3n 9.22.0 del proveedor si utiliza el gestor de AWS Auth.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-346\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:airflow_providers_amazon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"9.22.0\",\"matchCriteriaId\":\"9A3CFD46-11DF-4D34-B4AB-030546AD6920\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/61368\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/03/09/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/03/09/6\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-03-09T12:09:58.818Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25604\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-09T16:47:57.674471Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-09T16:48:09.704Z\"}}], \"cna\": {\"title\": \"Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Sungwuk Jung\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"medium\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow Providers Amazon\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\", \"lessThan\": \"9.22.0\", \"versionType\": \"semver\"}], \"packageName\": \"apache-airflow-providers-amazon\", \"collectionURL\": \"https://pypi.python.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/61368\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\\u00a0\\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\\n\\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u0026nbsp;\u003cbr\u003eThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\u003c/p\u003eYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-346\", \"description\": \"CWE-346: Origin Validation Error\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-03-09T10:39:05.883Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25604\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-09T16:48:12.786Z\", \"dateReserved\": \"2026-02-03T09:59:31.342Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-03-09T10:39:05.883Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-25604

Vulnerability from fkie_nvd - Published: 2026-03-09 11:16 - Updated: 2026-03-10 18:58

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

References

URL	Tags
security@apache.org	https://github.com/apache/airflow/pull/61368	Issue Tracking, Patch
security@apache.org	https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77	Mailing List
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/03/09/6	Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	apache	airflow_providers_amazon	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:airflow_providers_amazon:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A3CFD46-11DF-4D34-B4AB-030546AD6920",
              "versionEndExcluding": "9.22.0",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager."
    },
    {
      "lang": "es",
      "value": "En el gestor de AWS Auth, el origen de la autenticaci\u00f3n SAML se ha utilizado tal como lo proporcion\u00f3 el cliente y no se ha verificado contra la URL real de la instancia.\nEsto permiti\u00f3 obtener acceso a diferentes instancias con controles de acceso potencialmente diferentes al reutilizar la respuesta SAML de otras instancias.\n\nDeber\u00eda actualizarse a la versi\u00f3n 9.22.0 del proveedor si utiliza el gestor de AWS Auth."
    }
  ],
  "id": "CVE-2026-25604",
  "lastModified": "2026-03-10T18:58:48.887",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-09T11:16:06.077",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/apache/airflow/pull/61368"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/03/09/6"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-RV5F-CCPM-XJJ4

Vulnerability from github – Published: 2026-03-09 12:31 – Updated: 2026-03-10 01:22

Summary

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

Details

You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-amazon"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-10T01:22:21Z",
    "nvd_published_at": "2026-03-09T11:16:06Z",
    "severity": "MODERATE"
  },
  "details": "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.",
  "id": "GHSA-rv5f-ccpm-xjj4",
  "modified": "2026-03-10T01:22:21Z",
  "published": "2026-03-09T12:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25604"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/61368"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/commit/1a86aec01d827ba8caf41b645db56663a9a61850"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/03/09/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25604 (GCVE-0-2026-25604)

FKIE_CVE-2026-25604

GHSA-RV5F-CCPM-XJJ4

Tags

Sightings

Nomenclature