Executive brief
Apache Airflow's authentication system (FAB provider) is used by organizations to control access to Airflow deployments and manage task orchestration. When an administrator resets a user's password after a session cookie is compromised, the system fails to invalidate the attacker's existing session due to a data type mismatch in the session comparison logic. An attacker who holds a stolen session cookie retains full access to the victim's account even after the password is reset, defeating a critical security containment action.
Technical details
The vulnerability exists in the FAB provider's password reset functionality when using database-backed sessions. The root cause is a type mismatch: the reset_user_sessions() function compares Flask-Login's string session identifier against the user's integer database identifier, so the comparison always fails and no sessions are deleted. An attacker who possesses a valid session cookie (e.g., from credential theft or CSRF) can maintain access after a password reset. The attack requires the administrator or user to explicitly trigger the password reset command; the secure-cookie backend is unaffected as it lacks central session deletion. Apache Airflow FAB provider version 3.9.0 and later fix this issue by ensuring identifier comparison is performed consistently. A separate CVE-2026-86462 provides an alternative exploitation route via the Admin user-edit endpoint, both fixed in 3.9.0.
Affected products
- Apache Airflow FAB provider before 3.9.0
Timeline
- 2026-09-16: disclosed
- 2026-08-28: patched: Fix merged in PR #72198