PYSEC-2026-1147 Apache Airflow Fab Provider Insufficient Session Expiration vulnerability

🗓️ 07 Jul 2026 14:34:48Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Session expiry flaw in Airflow Fab Provider before 1.5.2 allows login after admin password change.

Reporter	Title	Published	Views	Family All 20
BDU FSTEC	The vulnerability of the Apache Airflow Fab Provider software, which is used for creating, monitoring, and orchestrating data processing scenarios in Apache Airflow, stems from incorrect session duration settings. This allows attackers to maintain a session in the system.	24 Mar 202500:00	–	bdu_fstec
Chainguard	CVE-2024-45033 vulnerabilities	8 Jan 202509:15	–	cgr
Circl	CVE-2024-45033	8 Jan 202508:49	–	circl
CNNVD	Apache Airflow 代码问题漏洞	8 Jan 202500:00	–	cnnvd
CVE	CVE-2024-45033	8 Jan 202508:41	–	cve
Cvelist	CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli	8 Jan 202508:41	–	cvelist
Github Security Blog	Apache Airflow Fab Provider Insufficient Session Expiration vulnerability	8 Jan 202509:30	–	github
Hacker One	Internet Bug Bounty: Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli	2 Apr 202510:40	–	hackerone
NVD	CVE-2024-45033	8 Jan 202509:15	–	nvd
OSV	CGA-XJ4Q-FCHV-JV5J	29 Jan 202600:48	–	osv

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45033
github	www.github.com/apache/airflow/pull/45139
github	www.github.com/apache/airflow
lists	www.lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st
pypi	www.pypi.org/project/apache-airflow-providers-fab
github	www.github.com/advisories/GHSA-8863-4qmg-fr45

07 Jul 2026 17:46Current

5.9Medium risk

Vulners AI Score5.9

CVSS 42.1

EPSS0.0092

airflow fab provider session expiry password change admin cli version 1.5.2