Is CVE-2026-82311 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82311 being exploited in the wild.

How severe is CVE-2026-82311?

Critical severity, with a CVSS score of 9.8, published 16 September 2026.

Which products and versions are affected?

Apache Airflow FAB provider before 3.9.0.

Is there a fix for CVE-2026-82311?

A patch was published on 2026-08-28: Fix merged in PR #72198 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82311 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82311?

Check whether you run Apache-Airflow-Providers-Fab. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82311: Apache Airflow FAB provider session invalidation bypass

CVE-2026-82311 · Severity: critical · CVSS 9.8 · Published 2026-09-16

Apache Airflow's authentication system (FAB provider) is used by organizations to control access to Airflow deployments and manage task orchestration. When an administrator resets a user's password after a session cookie is compromised, the system fails to invalidate the attacker's existing session due to a data type mismatch in the session comparison logic. An attacker who holds a stolen session cookie retains full access to the victim's account even after the password is reset, defeating a critical security containment action.

Technologies: Apache-Airflow-Providers-Fab. Vendors: Apache.

Quick answers

Is CVE-2026-82311 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82311 being exploited in the wild.
How severe is CVE-2026-82311?: Critical severity, with a CVSS score of 9.8, published 16 September 2026.
Which products and versions are affected?: Apache Airflow FAB provider before 3.9.0.
Is there a fix for CVE-2026-82311?: A patch was published on 2026-08-28: Fix merged in PR #72198 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82311 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82311?: Check whether you run Apache-Airflow-Providers-Fab. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the FAB provider's password reset functionality when using database-backed sessions. The root cause is a type mismatch: the reset_user_sessions() function compares Flask-Login's string session identifier against the user's integer database identifier, so the comparison always fails and no sessions are deleted. An attacker who possesses a valid session cookie (e.g., from credential theft or CSRF) can maintain access after a password reset. The attack requires the administrator or user to explicitly trigger the password reset command; the secure-cookie backend is unaffected as it lacks central session deletion. Apache Airflow FAB provider version 3.9.0 and later fix this issue by ensuring identifier comparison is performed consistently. A separate CVE-2026-86462 provides an alternative exploitation route via the Admin user-edit endpoint, both fixed in 3.9.0.

Affected products

Apache Airflow FAB provider before 3.9.0

Timeline

2026-09-16: disclosed
2026-08-28: patched: Fix merged in PR #72198

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.