CyberSecBulletin
CVE-2026-82311NVD status: Analyzed

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing…

Published Updated By the CyberSecBulletin desk

CVE-2026-82311 is a critical-severity vulnerability in Apache Airflow FAB provider from Apache, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 3.9.0 as the first without the flaw, so updating Apache Airflow FAB provider to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.98% chance of exploitation within 30 days, higher than 63% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Apache Airflow FAB provider to 3.9.0 or a later version.
  2. Update Apache-airflow-providers-fab to 3.9.0 or a later version.
  3. Read the advisory on github.com for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ApacheApache Airflow FAB provider2.4.2 up to, but not including, 3.9.03.9.0
ApacheApache-airflow-providers-fab2.4.2 up to, but not including, 3.9.03.9.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not evict them. Affects deployments using the FAB auth manager with `[fab] session_backend=database`. The trigger is an administrator (or the user) running the supported password-reset command as a containment action after a session cookie has been compromised; the secure-cookie backend is out of scope, as it documents that it cannot centrally delete sessions. apache-airflow-providers-fab 3.9.0 also fixes CVE-2026-86462, a second, independent route to the same outcome via the Admin user-edit endpoint; a single upgrade closes both. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which compares the identifiers consistently.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other references

Other vulnerabilities in Apache Airflow FAB provider

All Apache Airflow FAB provider vulnerabilities

Spotted an error? Tell us.