CVE-2026-25604: apache-airflow-providers-amazon

csirt@kutim:~/threat-intel/cve/CVE-2026-25604

CVSS 5.4 · Medium EPSS 0,53%

Kerentanan Origin Validation Error pada apache-airflow-providers-amazon. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

Rincian

Terbit di NVD: 9 Maret 2026
Terakhir diubah: 2 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-346: Origin Validation Error
EPSS (30 hari): 0,53% peluang dieksploitasi; lebih tinggi dari 43,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	apache-airflow-providers-amazon	Versi 8.0.0 hingga sebelum 9.22.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/apache/airflow/pull/61368 issue tracking · patch
http://www.openwall.com/lists/oss-security/2026/03/09/6 mailing list · advisory pihak ketiga
https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77 mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.