# CVE-2024-42447: Apache Airflow Providers FAB insufficient session expiration

Source: https://junglewise.ai/threats/cve-2024-42447-apache-airflow-providers-fab-insufficient-session-expiration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2024-42447 · Severity: medium · CVSS 4.2 · Published 2024-08-05

A vulnerability in the Apache Airflow FAB provider prevents users from properly logging out of the system. This means that if a user accesses Airflow from a shared or public computer, their session could remain active even after they attempt to sign out. An unauthorized person could potentially use the abandoned session to access sensitive data or perform actions on behalf of the original user.

Technologies: [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow), [apache-airflow-providers-fab (PyPI)](https://junglewise.ai/threats/technologies/pypi-apache-airflow-providers-fab). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-42447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-42447 being exploited in the wild.

**How severe is CVE-2024-42447?** Medium severity, with a CVSS score of 4.2, published 5 August 2024.

**Which products and versions are affected?** Apache Software Foundation Airflow Providers FAB 1.2.0, 1.2.1 (when used with Airflow 2.9.3); apache-airflow (PyPI) ECOSYSTEM:introduced=0,last_affected=1.2.1,last_affected=1.2.0; apache-airflow-providers-fab (PyPI) ECOSYSTEM:introduced=1.2.0,fixed=1.2.2.

**Is there a fix for CVE-2024-42447?** Yes. apache-airflow-providers-fab (PyPI): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-42447 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-42447?** Check whether you run Apache Software Foundation Airflow Providers FAB, apache-airflow (PyPI) or apache-airflow-providers-fab (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-airflow-providers-fab (PyPI): upgrade to 1.2.2 or later

  ```sh
  pip install "apache-airflow-providers-fab>=1.2.2"
  ```


## Technical details

An Insufficient Session Expiration vulnerability (CWE-613) exists in the Apache Airflow FAB (Flask AppBuilder) provider. The flaw is rooted in a version check logic error related to logout CSRF protection, which effectively prevents the logout mechanism from terminating the user session. The issue specifically affects FAB provider version 1.2.0 across all Airflow versions, and version 1.2.1 specifically when paired with Airflow 2.9.3. Attackers could leverage an unexpired session on a shared workstation to gain unauthorized access to the Airflow web interface. The issue is resolved in Apache Airflow Providers FAB version 1.2.2.

## Affected products

- Apache Airflow Providers FAB 1.2.0, 1.2.1 (when used with Airflow 2.9.3)

## Identifiers

- CVE-2024-42447
- GHSA-62qf-qm3g-fvcw
- PYSEC-2024-265
- PYSEC-2026-1146

## Timeline

- 2024-08-04: disclosed: Initial disclosure on oss-security mailing list
- 2024-08-05: advisory: GitHub and NVD advisories published

## References

- [https://github.com/apache/airflow/pull/40784](https://github.com/apache/airflow/pull/40784)
- [https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52](https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52)
- [http://www.openwall.com/lists/oss-security/2024/08/04/2](http://www.openwall.com/lists/oss-security/2024/08/04/2)
- [https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-265.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-265.yaml)

## Related threats

- [Apache Airflow Core API logout incomplete token revocation](https://junglewise.ai/threats/cve-2026-86473-apache-airflow-the-core-api-logout-endpoint-revokes-only-a)
- [Apache Airflow authentication bypass via session cookie precedence](https://junglewise.ai/threats/cve-2026-82355-when-a-request-to-the-airflow-core-api-carries-both-a-session)
- [Apache Airflow information disclosure in /assets/events API](https://junglewise.ai/threats/cve-2026-75158-apache-airflow-s-assets-events-api-returned-asset-events-for)
- [Apache Airflow authorization bypass in asset materialization and XCom endpoints](https://junglewise.ai/threats/cve-2026-68971-apache-airflow-authorization-bypass-in-asset-materialization-and)
- [Apache Airflow Task SDK variable masking bypass for list-shaped values](https://junglewise.ai/threats/cve-2026-68970-apache-airflow-task-sdk-variable-masking-bypass-for-list-shaped)