CVE-2026-25604
Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass
- Published
- Mar 9, 2026
- Updated
- Mar 9, 2026
- Assigning CNA
- apache
- Evidence observed
- Aug 19, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NLow · next 30 days
- Percentile
- 43.6%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.
Sources
A PoC for demonstrating CVE-2026-25604
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.