Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration in the session cleanup. An attacker can maintain unauthorized access by reusing a previously compromised...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration in the Admin user-edit PATCH process. An attacker can maintain unauthorized access by reusing a previousl...

gaiaflow (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-82311 via apache-airflow-providers-fab (2.4.4)

apache-airflow-providers-fab PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-fab and may be impacted: - gaiaflow =0.0.1, =0.0.3 Source cves: CVE-2026-82311 Source advisory:...

Origin Validation Error

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error in the idtoken validation. An attacker can gain unauthorized access by presenting a valid token issued for a...

gaiaflow (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-82310 via apache-airflow-providers-fab (2.4.4)

apache-airflow-providers-fab PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-fab and may be impacted: - gaiaflow =0.0.1, =0.0.3 Source cves: CVE-2026-82310 Source advisory:...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration due to the Core API accepting existing, unexpired tokens for accounts that have been deactivated by an...

CVE-2026-86466

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-82310

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82311

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

gaiaflow (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-82310 via apache-airflow-providers-fab (2.4.4)

apache-airflow-providers-fab PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-fab and may be impacted: - gaiaflow =0.0.1, =0.0.3 Source cves: CVE-2026-82310 Source advisory: MEND:CVE-2026-82310...

CVE-2026-82310

The apache-airflow-providers-fab package is vulnerable to insufficient session expiration when used with Airflow 3 and the FAB auth manager with Core API token authentication. The root cause is that while password authentication correctly rejects disabled accounts, the Core API continues to accep...

acceldata-o2a (1.0.0), acryl-datahub-airflow-plugin (>=0.9.5.1rc1, <=1.3.1.5rc6) +122 more potentially affected by CVE-2026-86462 via apache-airflow-providers-fab (>=1.0.2b0, <=2.4.4)

apache-airflow-providers-fab PYPI version =1.0.2b0, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.4.0, =0.1.0a1, =1.3.0, =0.1.1, =0.1.1, =0.10.2, =0.0.1, =0.1.2 and more Source cves: CVE-2026-86462 Source advisory: MEND:CVE-2026-86462...

CVE-2026-86462

The apache-airflow-providers-fab package is vulnerable to insufficient session expiration when using the FAB auth manager with database-backed sessions. Specifically, updating a user's password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allo...

CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

EUVD-2026-80318

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

acceldata-o2a (1.0.0), acryl-datahub-airflow-plugin (>=0.9.5.1rc1, <=1.3.1.5rc6) +122 more potentially affected by CVE-2026-82311 via apache-airflow-providers-fab (>=1.0.2b0, <=2.4.4)

apache-airflow-providers-fab PYPI version =1.0.2b0, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.4.0, =0.1.0a1, =1.3.0, =0.1.1, =0.1.1, =0.10.2, =0.0.1, =0.1.2 and more Source cves: CVE-2026-82311 Source advisory: MEND:CVE-2026-82311...