Apache Airflow FAB Auth Manager LDAP Filter Injection Vulnerability

A vulnerability allowing LDAP filter injection has been identified in the Apache Airflow FAB Auth Manager, specifically in versions prior to 3.6.4. This vulnerability (CWE-90) allows unauthenticated attackers to exfiltrate directory data or bypass authentication. The issue is reachable through the '/auth/token' endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized access or data exfiltration from the directory via LDAP.

Remediation

Users are advised to upgrade to Apache Airflow FAB provider version 3.6.4 or later. If an immediate upgrade is not possible, LDAP authentication should be disabled until the provider can be updated.