Read the docs
TI-2026-56768 Aliases CVE-2026-82310GHSA-vj39-hwrh-p32g

Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Priority LOW 36CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-613.

Summary

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement — so the account keeps its role-scoped access indefinitely after an administrator has disabled it. The user replays their own legitimate credential; no signature forgery or privilege escalation is involved, and the access stays within the roles the account already held. Affects deployments using Airflow 3 with the FAB auth manager and Core API token authentication, where an administrator deactivates an account whose row remains in the database and whose previously issued token has not expired. The trigger is administrative deactivation as a containment action, which silently fails to contain. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which rejects tokens naming a deactivated account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01004 63rd percentileScored 2026-11-07
Fix Fixed Apache Airflow FAB provider (Apache Software Foundation): 3.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow FAB provider2.0.0 to before 3.9.03.9.0Patch availableCNA
  • Apache Airflow FAB provider VendorApache Affected 2.0.0 to before 3.9.0 Fixed in 3.9.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*2.0.0 to before 3.9.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:* Versions 2.0.0 to before 3.9.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow FAB provider (Apache Software Foundation) Fixed in 3.9.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Airflow FAB provider 3.9.0

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB providerPriority MEDIUM 51
    • TI-2026-59161 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsPriority MEDIUM 49
    • TI-2026-59164 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedPriority LOW 37
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82310
  2. 2026-10-03 Alias added: GHSA-vj39-hwrh-p32g

References

Patch 1

Advisory 2

  • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2024-28416 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow CVSS 3.1CRITICAL 9.8
  • TI-2026-42383 Improper signature verification in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2026-59161 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions CVSS 3.1CRITICAL 9.1
  • TI-2026-52804 Origin validation error in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.1
  • TI-2024-30146 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences