CLEANSTART-2026-GK10237 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does

CVE-2026-82311 affects multiple packages. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. See references for individual vulnerability details...