CVE-2026-86467: CSRF in the SAML login of the Apache Airflow Amazon provider

What happened and what to do

The advisory CVE-2026-86467, published by Jarek Potiuk on the oss-sec list on October 19, 2026, rates as moderate a flaw in the SAML login flow of the AWS auth manager in the Apache Airflow Amazon provider. Versions before 9.38.0 are affected. The login handler discards the AuthnRequest ID, and the callback validates the assertion without requiring a matching InResponseTo. As a result, an unauthenticated attacker who can get a victim to load a crafted request may log the victim into the attacker's own account.

For a company running Airflow in production, the first step is to inventory all environments, including development and staging, and record the Amazon provider version in each one. Where the AWS auth manager with SAML is active, upgrading to 9.38.0 or later should be prioritized. As a complementary measure, authentication logs can be monitored for sessions opened in unrecognized accounts, logins followed by access to unusual DAGs and connections, and alerts can be created for those events. A simple dashboard showing the provider version per environment helps track the fix without relying on manual checks.

How the consultancy can help

Wendelmaques can diagnose how exposed your Airflow is to this flaw: an inventory of provider versions, a map of active SAML flows, and a review of authentication logs. We then implement the planned upgrade, monitoring for suspicious sessions, and a per-environment version dashboard, operated in your own infrastructure.

Next step

If your team runs Apache Airflow with AWS SAML login, send a short description of your setup: versions in use, number of environments, and how access is granted. We will then prepare a scoped proposal for diagnosis and remediation.