CVE-2026-86462criticalCWE-613

CVE-2026-86462: critical vulnerability in Apache Airflow FAB provider

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Published · Updated

Follow this CVE+ Monitor Apache Airflow FAB provider

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.8%
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed. This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Apache Software Foundation · Apache Airflow FAB provider
Related CVEs — Apache Airflow FAB provider

In the same product, most dangerous first.

CVE-2026-82310HIGHApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessEPSS 1.0%CVE-2026-82311CRITICALApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseEPSS 1.0%CVE-2026-59243CRITICALApache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)EPSS 0.6%CVE-2026-59245HIGHApache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)EPSS 0.6%CVE-2026-46745MEDIUMApache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/tokenEPSS 0.6%CVE-2026-75156CRITICALApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassEPSS 0.4%