Session Management Flaw in Apache Airflow FAB Provider

CVE-2026-86462

What is CVE-2026-86462?

The Apache Airflow FAB provider contains a vulnerability that allows an attacker to maintain access to a user's account even after the user changes their password. This occurs because the password change through the Admin user-edit PATCH endpoint does not invalidate the user's ongoing database-backed sessions. If an attacker possesses a copy of the victim's session cookie prior to the password change, they continue to have full access to the victim's account without requiring further interaction. This issue is separate from another vulnerability (CVE-2026-82311) and necessitates users to upgrade to version 3.9.0 or later to ensure proper session invalidation following password modifications.

References