Read the docs
TI-2026-59161 Aliases CVE-2026-86462GHSA-5j5v-7fmw-4hvh

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Priority MEDIUM 49CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-613.

Summary

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed. This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00828 57th percentileScored 2026-11-07
Fix Fixed Apache Airflow FAB provider (Apache Software Foundation): 3.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow FAB provider3.2.0 to before 3.9.03.9.0Patch availableCNA
  • Apache Airflow FAB provider VendorApache Affected 3.2.0 to before 3.9.0 Fixed in 3.9.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*3.2.0 to before 3.9.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.9.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow FAB provider (Apache Software Foundation) Fixed in 3.9.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Airflow FAB provider 3.9.0

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB providerPriority MEDIUM 51
    • TI-2026-59164 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedPriority LOW 37
    • TI-2026-56768 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessPriority LOW 36
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86462
  2. 2026-10-03 Alias added: GHSA-5j5v-7fmw-4hvh

References

Patch 1

Advisory 2

Other 1

  • TI-2026-56769 Insufficient session expiration in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2024-28416 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow CVSS 3.1CRITICAL 9.8
  • TI-2026-42383 Improper signature verification in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.8
  • TI-2026-52804 Origin validation error in Apache Airflow FAB provider CVSS 3.1CRITICAL 9.1
  • TI-2024-30146 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli CVSS 3.1HIGH 8.1
  • TI-2026-42385 Improper privilege management in Apache Airflow FAB provider CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences