TI-2024-30146 Aliases CVE-2024-45033 GHSA-8863-4qmg-fr45

Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

LOW 39CWE-613Published 2025-01-08 · Updated 2025-01-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 which was addressed in Apache-Airflow 2.7.0 Users are recommended to upgrade to version 1.5.2, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00988 62nd percentileScored 2026-11-07

Fix Fixed Apache Airflow Fab Provider (Apache Software Foundation): 1.5.2apache-airflow-providers-fab (PyPI): 1.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Airflow Fab Provider	before 1.5.2	1.5.2	Patch available	CNA
—	apache-airflow-providers-fab (PyPI)	before 1.5.2	1.5.2	Patch available	GHSA-8863-4qmg-fr45

Apache Airflow Fab Provider VendorApache Affected before 1.5.2 Fixed in 1.5.2 Patch available CNA
apache-airflow-providers-fab (PyPI) Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available GHSA-8863-4qmg-fr45

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:apache-airflow-providers-fab::::::::	before 1.5.2	Vulnerable	Apache

cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:* Versions before 1.5.2 Vulnerable ·Apache

Remediation

Fix · CNA Apache Airflow Fab Provider (Apache Software Foundation) Fixed in 1.5.2
Fix · GHSA-8863-4qmg-fr45 apache-airflow-providers-fab (PyPI) Fixed in 1.5.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-45033
2026-10-03 Alias added: GHSA-8863-4qmg-fr45

References

Patch 1

https://github.com/apache/airflow/pull/45139

Advisory 2

Other 1

https://github.com/apache/airflow

TI-2026-56769 Insufficient session expiration in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
TI-2024-28416 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow CVSS 3.1CRITICAL 9.8
TI-2026-42383 Improper signature verification in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
TI-2026-59161 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CVSS 3.1CRITICAL 9.1
TI-2026-52804 Origin validation error in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.1
TI-2026-42385 Improper privilege management in Apache Airflow FAB provider CVSS 3.1HIGH 8.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences