CVE-2026-82310

Apache Airflow 3 deployments using the FAB auth manager with Core API token authentication are affected by a flaw where deactivating a user account does not invalidate previously issued JWTs . The Core API continues to accept existing, unexpired tokens naming the deactivated account and allows th...

CVE-2026-86462

Apache Airflow FAB provider contains a session-invalidation gap in the Admin user-edit PATCH endpoint . When a user's password is changed through this path, existing database-backed sessions are not invalidated because the PATCH handler never calls the session-invalidation helper. An attacker alr...

CVE-2026-82311

Apache Airflow FAB provider (apache-airflow-providers-fab) contains a flaw where resetting a user's password fails to invalidate that user's existing database-backed sessions . The root cause is a type mismatch: the cleanup routine compares the string _user_id that Flask-Login stores in the sessi...

CVE-2024-42447

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 when used with Apache Airflow 2.9.3 and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out. FAB provider 1.2.1 only affected...