Apache Airflow FAB provider 3.9.0 fixes three moderate CVEs: broken session invalidation on password reset and missing Authentik id_token issuer/audience validation

apache-airflow-providers-fab 3.9.0 patches three moderate vulnerabilities: password resets fail to invalidate database-backed sessions (CVE-2026-82311, CVE-2026-86462), and Authentik id_tokens are accepted without issuer/audience checks (CVE-2026-86466).

Three oss-security advisories published 2026-09-15 disclose vulnerabilities in the Apache Airflow Flask AppBuilder (FAB) auth provider, all fixed in version 3.9.0 and all rated moderate. CVE-2026-82311 affects versions 2.4.2 before 3.9.0: resetting a user's password fails to delete that user's existing database-backed sessions despite documented behavior saying it does, because the cleanup compares the string identifier Flask-Login stores in the session against the user's integer database _user_id, so the comparison always evaluates false. CVE-2026-86462 affects versions 3.2.0 before 3.9.0: changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions, so an attacker who already holds a copy of the victim's session cookie retains full access as that user after the password change. CVE-2026-86466 affects versions before 3.9.0 (no lower bound stated): the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens, so a token minted by the same Authentik identity provider for a different client application can be presented to Airflow and authenticate its holder. The reports state differing affected version ranges (2.4.2+, 3.2.0+, and unspecified lower bounds respectively), which may reflect when each flawed code path was introduced; all agree the fix is version 3.9.0.

• All three CVEs affect the apache-airflow-providers-fab package and are fixed in version 3.9.0
• CVE-2026-82311: affects 2.4.2 before 3.9.0; password reset does not delete database-backed sessions because a string vs integer _user_id comparison is always false; severity moderate
• CVE-2026-86462: affects 3.2.0 before 3.9.0; Admin user-edit PATCH password change leaves database-backed sessions valid, so stolen session cookies survive a password reset; severity moderate
• CVE-2026-86466: affects versions before 3.9.0; Authentik id_token issuer and audience claims are not validated, allowing tokens minted for other Authentik client applications to authenticate to Airflow; severity rated moderate by the…
• All three advisories were posted to oss-security on 2026-09-15 within roughly 4 minutes of each other
• Affected version ranges differ across the reports (2.4.2 < 3.9.0, 3.2.0 < 3.9.0, and < 3.9.0 with no lower bound stated)