{"id":41977,"date":"2026-10-20T12:33:07","date_gmt":"2026-10-20T04:33:07","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-86467"},"modified":"2026-10-20T12:33:07","modified_gmt":"2026-10-20T04:33:07","slug":"cve-2026-86467","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-86467","title":{"rendered":"CVE-2026-86467 &#8211; Apache Airflow Amazon provider: the AWS auth manager&#8217;s SAML login flow does not bind the a"},"content":{"rendered":"<p>Apache Airflow Amazon provider: the AWS auth manager&#8217;s SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim&#8217;s browser using the attacker&#8217;s own assertion, silently logging the victim into the attacker&#8217;s Airflow account. Subsequent work the victim performs lands in a session the attacker controls.<\/p>\n<p>Affects deployments using the AWS auth manager with SAML authentication. The victim needs only to visit an attacker-controlled page; no Airflow account or credential is required of the attacker. This is the same login-CSRF class fixed in the Keycloak auth manager as CVE-2026-40948.<\/p>\n<p>Users of apache-airflow-providers-amazon are recommended to upgrade to version 9.38.0, which fixes the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apache Airflow Amazon provider: the AWS auth manager&#8217;s SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the ca<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41977","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}