https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:52:29.641749+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10701 bdu:2026-10701 2026-10-06T01:52:29.714498+00:00 bdu:2026-10701 https://cve.radiocsirt.org/vuln/cleanstart-2026-ex36838 Withdrawn: CLEANSTART-2026-EX36838 — Security fixes in airflow-3 3.3.0-r2 2026-10-06T01:52:29.714537+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Package airflow-3 version 3.3.0-r2 fixes 7 vulnerabilities: CVE-2026-69244, CVE-2026-59881, CVE-2026-69243, CVE-2026-69247, CVE-2026-69249...

 https://cve.radiocsirt.org/vuln/euvd-2026-369572 EUVD-2026-369572 2026-10-06T01:52:29.714568+00:00 EUVD-2026-369572 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59243 fkie_cve-2026-59243 2026-10-06T01:52:29.714581+00:00

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

 https://cve.radiocsirt.org/vuln/ghsa-q5r3-w69r-hrfw GHSA-q5r3-w69r-hrfw 2026-10-06T01:52:29.714607+00:00

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2551 WID-SEC-W-2026-2551 — Apache Airflow FAB provider: Schwachstelle ermöglicht Erlangen von Administratorrechten 2026-10-06T01:52:29.714626+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Airflow FAB provider ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Administratorrechte zu erlangen.