CVE-2026-82311

In the Apache Airflow FAB provider, resetting a user's password fails to delete that user's existing database-backed sessions because the cleanup compares the string identifier Flask-Login stores in the session against the user's integer database ID, so the comparison is always false and no session is removed. The flaw is triggered when an administrator or the user runs the supported password-reset command, typically as a containment step after a session cookie has been compromised. An attacker who already holds a copy of the victim's session cookie therefore retains authenticated access as that user even after the password is changed. Only deployments using the FAB auth manager with [fab] session_backend=database are affected; the secure-cookie backend is out of scope. No public proof-of-concept or in-the-wild exploitation is known, and version 3.9.0 fixes this bug along with CVE-2026-86462, a second route to the same outcome via the Admin user-edit endpoint.

What to do: Upgrade apache-airflow-providers-fab to version 3.9.0 or later, which corrects the identifier comparison and also fixes CVE-2026-86462. Until upgraded, do not rely on a password reset to evict a suspected cookie thief: manually delete the user's rows from the database session store (or invalidate sessions another way, such as rotating the secret key) and audit session records for unexpected activity. Check whether your deployment sets [fab] session_backend=database to confirm exposure.