Session Management Flaw in Apache Airflow FAB Provider

CVE-2026-82311

What is CVE-2026-82311?

A vulnerability in the Apache Airflow FAB provider allows an attacker to maintain access to a user's session even after a password reset. This occurs because resetting a user's password does not invalidate existing database-backed sessions, as intended, due to a flaw in the session identifier comparison process. Specifically, the vulnerability stems from the way Flask-Login handles session identifiers, leading to potential unauthorized access post password change. Upgrading to version 3.9.0 or later effectively resolves this issue by ensuring consistent identifier comparisons.

References