CVE-2026-82311

Published: Set 16, 2026 Last Modified: Set 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not evict them.

Affects deployments using the FAB auth manager with `[fab] session_backend=database`. The trigger is an administrator (or the user) running the supported password-reset command as a containment action after a session cookie has been compromised; the secure-cookie backend is out of scope, as it documents that it cannot centrally delete sessions.

apache-airflow-providers-fab 3.9.0 also fixes CVE-2026-86462, a second, independent route to the same outcome via the Admin user-edit endpoint; a single upgrade closes both.

Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which compares the identifiers consistently.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0020
Percentile
0,1th
Updated

Single Data Point

Only one EPSS measurement is available for this CVE. Trend analysis requires multiple data points over time.

613

Insufficient Session Expiration

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
Application

Apache-Airflow-Providers-Fab by Apache

Product Information
Vendor Apache
Product Apache-Airflow-Providers-Fab
Version Range Affected
From 2.4.2 (inclusive)
To 3.9.0 (exclusive)
cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/apache/airflow/pull/72198
https://github.com/apache/airflow/pull/72198
https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjv…
https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw
https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjv…
https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.…
https://www.cve.org/CVERecord?id=CVE-2026-86462
https://www.cve.org/CVERecord?id=CVE-2026-86462