CVE-2026-25604

MediumCVSS 5.4/10Last modified Jul 2, 2026

Description

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.

You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow Providers Amazon	>= 8.0.0, < 9.22.0

References

https://github.com/apache/airflow/pull/61368Issue Tracking, Patch
https://lists.apache.org/thread/spwwrsmwxod7fpttcd7n7zs46j839l77Mailing List
http://www.openwall.com/lists/oss-security/2026/03/09/6Mailing List, Third Party Advisory

Timeline

Published: Mar 9, 2026
Last modified: Jul 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-256057.1A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without prop CVE-2026-256068.7A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters al CVE-2026-256075.7Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with CVE-2026-256082.3STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain CVE-2026-256094.3Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-25618.8A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdca CVE-2026-256106.5An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.CVE-2026-256117.5A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.CVE-2026-256126.5The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collec CVE-2026-256136.5An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.CVE-2026-256147.5Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.CVE-2026-256157.2Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.