CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider 2.4.2-3.8.x password reset never deletes sessions because a string/int _user_id comparison is always false.
CVE-2026-82311 affects apache-airflow-providers-fab versions 2.4.2 before 3.9.0. Resetting a user's password fails to delete that user's existing database-backed sessions despite documented behavior saying it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison always evaluates false. Severity is rated moderate.
- Affects apache-airflow-providers-fab 2.4.2 before 3.9.0
- Password reset does not delete database-backed sessions
- String vs integer _user_id comparison always false
- Documented session-invalidation behavior broken since 2.4.2
- CVEs
- CVE-2026-82311
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82311 | Insufficient session expiration after password reset in Apache Airflow FAB provider | 9.8 | — |
From the original article
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow FAB provider (apache-airflow-providers-fab) 2. 4. 2 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.