CVE-2026-86462

In the Apache Airflow FAB provider, changing a user's password through the Admin user-edit PATCH endpoint fails to invalidate that user's existing database-backed sessions, a CWE-613 insufficient session expiration flaw. The trigger is routine and requires no attacker interaction with the endpoint: an administrator or the user themselves simply changes the password. An attacker who already captured a copy of the victim's session cookie therefore keeps full access as that user even after the password change, defeating the purpose of the reset. Any deployment running apache-airflow-providers-fab before 3.9.0 with the FAB auth manager and database-backed sessions is affected, including those already patched for CVE-2026-82311, since that earlier fix addressed a different code path (an identifier comparison in the session-invalidation helper) and the PATCH endpoint never calls that helper at all. No public proof-of-concept, KEV listing, or CVSS score is yet available, and exploitation is not known to be occurring.

What to do: Upgrade apache-airflow-providers-fab to version 3.9.0 or later, even if you already applied the CVE-2026-82311 fix, since that patch does not cover this endpoint. Until patched, treat a password change as insufficient to evict an attacker: manually invalidate existing database-backed sessions for affected users (e.g., clear the session store or rotate the webserver secret key, which invalidates all signed session cookies). Check logs for continued activity from a user's old session cookie after any recent password change.