SecBoard
Zurück zur CVE-Übersicht

CVE-2026-75156

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Risk Signal Score23/100 — NIEDRIG
  • CVSS 9.1 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.1

Technische Schwere

Beschreibung

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attacker creates — passes signature verification, and the username and role assignments are then read from that attacker-controlled token. Anyone able to register an Azure tenant can therefore authenticate to the Airflow UI with no prior access to the deployment. The fix for **CVE-2026-59243** was incomplete, and this advisory closes the remaining gap: that fix made the provider verify the `id_token` signature, but did not add issuer or audience checks. Operators who already applied the CVE-2026-59243 fix are **still affected and must upgrade again** — 3.7.3 is the release that shipped that fix, so every version containing it falls inside this affected range. Upgrade to apache-airflow-providers-fab `3.8.1` or later.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection focuses on unusual or unauthorized Azure AD OAuth login attempts to Apache Airflow, specifically looking for logins from unexpected tenants or with unusual role assignments. This requires logging of OAuth authentication events within Airflow and potentially correlating with Azure AD sign-in logs.

Sentinel/Defender KQL

// This query requires detailed logging of Airflow authentication events, specifically OAuth logins.
// Look for successful logins where the 'issuer' or 'tenant ID' in the token does not match expected values.
// This is a conceptual query as specific log sources and fields for Airflow OAuth are not provided.
AirflowLogs
| where LogType == "OAuthLogin"
| where OAuthProvider == "AzureAD"
| extend Issuer = extractjson("$.id_token.iss", TokenClaims, typeof(string))
| extend TenantId = extractjson("$.id_token.tid", TokenClaims, typeof(string))
| where Issuer !contains "<YOUR_EXPECTED_AZURE_TENANT_ID>" // Replace with your expected tenant ID or domain
  or TenantId !contains "<YOUR_EXPECTED_AZURE_TENANT_ID>"
| project TimeGenerated, UserName, OAuthProvider, Issuer, TenantId, ClientIP, UserAgent, TokenClaims
| sort by TimeGenerated desc

Splunk SPL

# This query requires detailed logging of Airflow authentication events, specifically OAuth logins.
# Look for successful logins where the 'issuer' or 'tenant ID' in the token does not match expected values.
# This is a conceptual query as specific log sources and fields for Airflow OAuth are not provided.
source="airflow_logs" LogType="OAuthLogin" OAuthProvider="AzureAD"
| spath input=TokenClaims path=id_token.iss output=Issuer
| spath input=TokenClaims path=id_token.tid output=TenantId
| where NOT (match(Issuer, ".*<YOUR_EXPECTED_AZURE_TENANT_ID>.*") OR match(TenantId, ".*<YOUR_EXPECTED_AZURE_TENANT_ID>.*"))
| table _time, UserName, OAuthProvider, Issuer, TenantId, ClientIP, UserAgent, TokenClaims

Sigma

title: Apache Airflow Azure AD OAuth Issuer/Audience Bypass
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation of CVE-2026-75156 in Apache Airflow where Azure AD id_tokens are not properly validated.
author: SecBoard
date: 2026/08/18
references:
  - https://github.com/apache/airflow/pull/71735
logsource:
  product: airflow
  service: auth
detection:
  selection:
    LogType: 'OAuthLogin'
    OAuthProvider: 'AzureAD'
    # This assumes 'Issuer' and 'TenantId' fields are extracted from the token claims in logs.
    # Adjust field names based on actual log schema.
    # Replace '<YOUR_EXPECTED_AZURE_TENANT_ID>' with your organization's Azure AD tenant ID or domain.
    # This is a conceptual rule and requires specific log field mapping.
    Issuer|contains|all:
      - 'sts.windows.net/'
      - 'login.microsoftonline.com/'
    Issuer|not contains: '<YOUR_EXPECTED_AZURE_TENANT_ID>'
    TenantId|not contains: '<YOUR_EXPECTED_AZURE_TENANT_ID>'
  condition: selection
level: high

Elastic ES|QL

// This query requires detailed logging of Airflow authentication events, specifically OAuth logins.
// Look for successful logins where the 'issuer' or 'tenant ID' in the token does not match expected values.
// This is a conceptual query as specific log sources and fields for Airflow OAuth are not provided.
FROM airflow_logs
| WHERE LogType == "OAuthLogin" AND OAuthProvider == "AzureAD"
| WITH
    extract_json(TokenClaims, '$.id_token.iss') AS Issuer,
    extract_json(TokenClaims, '$.id_token.tid') AS TenantId
| WHERE NOT (Issuer LIKE '%<YOUR_EXPECTED_AZURE_TENANT_ID>%' OR TenantId LIKE '%<YOUR_EXPECTED_AZURE_TENANT_ID>%')
| SELECT @timestamp, UserName, OAuthProvider, Issuer, TenantId, ClientIP, UserAgent, TokenClaims
| ORDER BY @timestamp DESC

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • login.microsoftonline.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen