Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

oss-security ()1
Read at seclists.org
Part of a story covered by 3 sourcesApache Airflow FAB provider 3.9.0 fixes three moderate CVEs: broken session invalidation on password reset and missing Authentik id_token issuer/audience validationMerged summary & timeline
AI summary · glm-5.3Summaries by Vani AI

Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.

CVE-2026-86462 affects apache-airflow-providers-fab versions 3.2.0 before 3.9.0. Changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie retains full access as that user after the password change. Severity is rated moderate.

Key facts
  • Affects apache-airflow-providers-fab 3.2.0 before 3.9.0
  • Admin PATCH password change leaves DB sessions valid
  • Stolen session cookies survive password reset
  • Fixed in FAB provider 3.9.0
Analyze CVE-2026-86462 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-86462
Tags
apache-airflowcvefab-providerpassword-resetsession-fixationsession-management

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86462
Insufficient Session Expiration in Apache Airflow FAB Provider password change
9.1—

From the original article

Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) 3. 2. 0 before 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.