CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider 2.0.0-3.8.x lets deactivated users keep unexpired Core API JWTs and mint replacements indefinitely.
CVE-2026-82310 affects apache-airflow-providers-fab versions 2.0.0 before 3.9.0. Deactivating a user account does not stop tokens issued before deactivation. While password authentication correctly rejects the disabled account, the Core API continues to accept an existing unexpired token naming it and lets that token mint a replacement. Severity is rated moderate.
- Affects apache-airflow-providers-fab 2.0.0 before 3.9.0
- Deactivated accounts keep working via pre-existing JWTs
- Core API lets old tokens mint replacement tokens
- Password auth correctly rejects disabled accounts, JWT auth does not
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82310 | Stale JWTs Let Deactivated Users Retain Access in Apache Airflow FAB Provider | 7.2 | — |
From the original article
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) 2. 0. 0 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.