CVE-2026-86462 in Airflow
Summary
by MITRE • 09/16/2026
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed.
This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one.
Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability in question represents a critical session management flaw within the Apache Airflow FAB provider, specifically affecting deployments that utilize the Flask-AppBuilder authentication manager with database-backed sessions. The core technical deficiency lies in the implementation of the Admin user-edit PATCH endpoint, which is responsible for updating user attributes including passwords. When an administrator or the affected user themselves initiates a routine password change through this interface, the system updates the credential hash stored in the backend database but fails to execute any logic to invalidate existing active sessions associated with that account. This omission means that the session tokens issued prior to the password reset remain valid and authenticated by the server, creating a persistent state of unauthorized access for anyone possessing those specific session cookies.
The operational impact of this flaw is severe because it effectively nullifies the security benefit of changing a user's password in scenarios where an attacker has already compromised or obtained a copy of the victim's session cookie. In standard secure authentication flows, a password change should serve as a definitive revocation mechanism for all active sessions to prevent persistent unauthorized access even if credentials are leaked. Here, however, an attacker who intercepts or steals a valid session ID can continue to operate with full privileges under that user identity indefinitely, regardless of subsequent password changes intended to remediate the initial compromise. This behavior undermines fundamental security principles regarding credential revocation and session lifecycle management, leaving organizations vulnerable to persistent intrusion even after they believe they have mitigated the breach by resetting credentials.
This issue is distinct from CVE-2026-82311, which addressed a separate but related problem involving identifier comparison logic within a session-invalidation helper function. While that previous fix improved general session handling robustness, it did not resolve this specific endpoint because the PATCH route for user editing does not invoke the aforementioned helper at all. Consequently, organizations that applied patches for CVE-2026-82311 remain vulnerable to this attack vector unless they also upgrade their FAB provider components. The lack of integration between the password update logic and session invalidation mechanisms highlights a gap in the application's security architecture where critical state changes are not synchronized with authentication context cleanup procedures.
From an industry standards perspective, this vulnerability aligns closely with CWE-613, which describes insufficient session expiration or revocation, as well as aspects of CWE-287 regarding improper authentication mechanism identification if one considers how the system fails to distinguish between legitimate and compromised sessions post-reset. In terms of MITRE ATT&CK tactics, this flaw facilitates Persistence by allowing an attacker to maintain access through valid but stale session tokens after a security control (password change) is triggered. It also relates to Defense Evasion as it allows attackers to bypass intended revocation mechanisms that should terminate their foothold in the system.
To mitigate this risk, organizations running Apache Airflow with the FAB provider must upgrade immediately to version 3.9.0 or later, which includes the necessary code changes to ensure that password updates trigger a comprehensive invalidation of all active database-backed sessions for the affected user. Additionally, administrators should review their current session management policies and consider implementing additional controls such as shorter session lifetimes or explicit logout mechanisms upon sensitive account modifications. Regular auditing of active sessions and monitoring for anomalous activity following credential changes can provide an extra layer of defense against attackers attempting to exploit this specific gap in session revocation logic.