CVE-2026-82310

In apache-airflow-providers-fab used with Apache Airflow 3's FAB auth manager, deactivating a user account does not invalidate access tokens (JWTs) already issued to that account, so the Core API keeps accepting any unexpired token naming the disabled user and even lets that token mint a replacement. The flaw (CWE-613, insufficient session expiration) is triggered whenever an administrator deactivates an account as an offboarding or containment step while the user's row remains in the database and a previously issued token has not expired. A deactivated user who replays their own legitimate token retains role-scoped Core API access indefinitely — no signature forgery or privilege escalation is involved, and access stays within the roles the account already held — so deactivation-based containment silently fails. Only deployments using Airflow 3 with the FAB auth manager and Core API token authentication are affected; password authentication correctly rejects the disabled account. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and the issue is not yet CVSS-scored.

What to do: Upgrade apache-airflow-providers-fab to version 3.9.0 or later, which rejects tokens naming a deactivated account. Until upgraded, when deactivating a user also delete the account row or rotate the API JWT signing secret to invalidate outstanding tokens, and review Core API audit logs for any activity by recently deactivated accounts.