Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the way the Apache Airflow FAB Auth Manager handles LDAP authentication. Specifically, two functions, _search_ldap and _ldap_get_nested_groups within the AirflowFabSecurityManagerOverride class, were found to be vulnerable to LDAP injection. The root cause was the direct concatenation of user-provided input (username and user_dn) into LDAP filter strings without proper escaping. This allowed an unauthenticated attacker to inject malicious LDAP filter syntax, thereby manipulating the queries sent to the LDAP server. This could lead to unauthorized data exfiltration from the directory or, in some cases, authentication bypass. The patch addresses this by introducing the ldap.filter.escape_filter_chars() function to sanitize the user input before it is included in the LDAP filter, effectively neutralizing the injection vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow-providers-fab | pip | < 3.6.4 | 3.6.4 |
