CVE-2026-46745: Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability

May 26, 2026 (updated June 30, 2026)

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. If immediate upgrade is not possible, disable LDAP authentication until the provider can be updated.

References

github.com/advisories/GHSA-g283-w6fp-c4fc
github.com/apache/airflow/commit/3f7756bea71a7c7988511ec0557314ffb15fbe5e
github.com/apache/airflow/pull/66417
lists.apache.org/thread/dvfy0bs181xwsrjrd3y5c55ztbzm8yhh
nvd.nist.gov/vuln/detail/CVE-2026-46745

Code Behaviors & Features

Detect and mitigate CVE-2026-46745 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →