CVE-2026-25604

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25604", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-02-03T09:59:31.342Z", "datePublished": "2026-03-09T10:39:05.883Z", "dateUpdated": "2026-03-09T16:48:12.786Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-providers-amazon", "product": "Apache Airflow Providers Amazon", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "9.22.0", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Sungwuk Jung"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.&nbsp;<br>This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.</p>You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.<br><br>"}], "value": "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager."}], "metrics": [{"other": {"content": {"text": "medium"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "description": "CWE-346: Origin Validation Error", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-09T10:39:05.883Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/61368"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/09/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-09T12:09:58.818Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T16:47:57.674471Z", "id": "CVE-2026-25604", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T16:48:12.786Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/09/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-09T12:09:58.818Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25604", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T16:47:57.674471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T16:48:09.704Z"}}], "cna": {"title": "Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Sungwuk Jung"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "medium"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow Providers Amazon", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "9.22.0", "versionType": "semver"}], "packageName": "apache-airflow-providers-amazon", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/61368", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.", "supportingMedia": [{"type": "text/html", "value": "<p>In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.&nbsp;<br>This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.</p>You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-03-09T10:39:05.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25604", "state": "PUBLISHED", "dateUpdated": "2026-03-09T16:48:12.786Z", "dateReserved": "2026-02-03T09:59:31.342Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-03-09T10:39:05.883Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-providers-amazon", "product": "Apache Airflow Providers Amazon", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "9.22.0", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D7E7AEF-0618-4850-ABD5-A80E90CD8F6D", "versionEndExcluding": "9.22.0", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.\u00a0\nThis allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.\n\nYou should upgrade to 9.22.0 version of provider if you use AWS Auth Manager."}, {"lang": "es", "value": "En el gestor de AWS Auth, el origen de la autenticaci\u00f3n SAML se ha utilizado tal como lo proporcion\u00f3 el cliente y no se ha verificado contra la URL real de la instancia.\nEsto permiti\u00f3 obtener acceso a diferentes instancias con controles de acceso potencialmente diferentes al reutilizar la respuesta SAML de otras instancias.\n\nDeber\u00eda actualizarse a la versi\u00f3n 9.22.0 del proveedor si utiliza el gestor de AWS Auth."}], "id": "CVE-2026-25604", "lastModified": "2026-07-02T16:35:27.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25604", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T16:47:57.674471Z", "version": "2.0.3"}}]}, "published": "2026-03-09T11:16:06.077", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/airflow/pull/61368"}, {"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/09/6"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,9.22.0)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 90.0, "source": "matching"}]}, "original": {"product": "Apache Airflow Providers Amazon", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache-airflow-providers-amazon", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-16T10:15:57.923368+00:00", "value": {"mitigation_remediation": ["Upgrade the Apache Airflow Providers Amazon package to version 9.22.0 or later, which removes the insecure origin handling in AWS Auth Manager.", "Disable or remove the AWS Auth Manager functionality if it is not required, to eliminate the vulnerable code path.", "Configure Airflow to validate the Origin header or enforce strict host checks for all SAML requests, ensuring that SAML responses are only accepted from the intended instance.", "Monitor Airflow logs for unexpected Host header values or SAML authentication attempts, and investigate any anomalies promptly."], "summary": {"action": "Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Apache Airflow Providers Amazon package, used in Apache Airflow deployments that enable the AWS Auth Manager. The specific versions impacted are those preceding the release that introduced the fix; upgrading to version 9.22.0 or later removes the issue.", "description_and_impact": "In the AWS Auth Manager, the SAML authentication process trusts the origin supplied by the client without validating it against the actual instance URL. This flaw allows an attacker to craft a Host header that points to a different Airflow instance and reuse a SAML response generated for that instance to gain access. The result is an authentication bypass that can expose data or controls belonging to separate Airflow deployments. The underlying weakness is a host header injection, identified as CWE\u2011346.", "risk_and_exploitability": "The CVSS score for this flaw is 5.4, indicating moderate severity, and the EPSS score is below 1%, showing a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to send requests with a manipulated Host header and provide a valid SAML response from another instance. Once the request is accepted, the authentication bypass occurs, potentially granting the attacker unauthorized access to protected resources."}}}}, "created": "2026-03-10T14:07:32.909516+00:00", "updated": "2026-04-16T10:30:16.165489+00:00", "vendors": ["apache", "apache$PRODUCT$apache-airflow-providers-amazon"]}