# CVE-2026-82311: Apache Airflow FAB provider session invalidation bypass

Source: https://junglewise.ai/threats/cve-2026-82311-apache-airflow-fab-provider-session-invalidation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82311 · Severity: critical · CVSS 9.8 · Published 2026-09-16

Apache Airflow's authentication system (FAB provider) is used by organizations to control access to Airflow deployments and manage task orchestration. When an administrator resets a user's password after a session cookie is compromised, the system fails to invalidate the attacker's existing session due to a data type mismatch in the session comparison logic. An attacker who holds a stolen session cookie retains full access to the victim's account even after the password is reset, defeating a critical security containment action.

Technologies: [Apache-Airflow-Providers-Fab](https://junglewise.ai/threats/technologies/apache-airflow-providers-fab). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82311 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82311 being exploited in the wild.

**How severe is CVE-2026-82311?** Critical severity, with a CVSS score of 9.8, published 16 September 2026.

**Which products and versions are affected?** Apache Airflow FAB provider before 3.9.0.

**Is there a fix for CVE-2026-82311?** A patch was published on 2026-08-28: Fix merged in PR #72198 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82311 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82311?** Check whether you run Apache-Airflow-Providers-Fab. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the FAB provider's password reset functionality when using database-backed sessions. The root cause is a type mismatch: the reset_user_sessions() function compares Flask-Login's string session identifier against the user's integer database identifier, so the comparison always fails and no sessions are deleted. An attacker who possesses a valid session cookie (e.g., from credential theft or CSRF) can maintain access after a password reset. The attack requires the administrator or user to explicitly trigger the password reset command; the secure-cookie backend is unaffected as it lacks central session deletion. Apache Airflow FAB provider version 3.9.0 and later fix this issue by ensuring identifier comparison is performed consistently. A separate CVE-2026-86462 provides an alternative exploitation route via the Admin user-edit endpoint, both fixed in 3.9.0.

## Affected products

- Apache Airflow FAB provider before 3.9.0

## Timeline

- 2026-09-16: disclosed
- 2026-08-28: patched: Fix merged in PR #72198

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/72198](https://github.com/apache/airflow/pull/72198)

## Related threats

- [Apache Airflow FAB provider authentication bypass in Authentik OAuth](https://junglewise.ai/threats/cve-2026-86466-apache-airflow-fab-provider-authentication-bypass-in-authentik)
- [Apache Airflow FAB provider token revocation bypass for deactivated accounts](https://junglewise.ai/threats/cve-2026-82310-apache-airflow-fab-provider-token-revocation-bypass-for)
- [Apache Airflow FAB provider session invalidation bypass on password change](https://junglewise.ai/threats/cve-2026-86462-apache-airflow-fab-provider-session-invalidation-bypass-on)
- [Apache Airflow FAB provider auth bypass in Azure AD OAuth](https://junglewise.ai/threats/cve-2026-75156-apache-airflow-fab-provider-auth-bypass-in-azure-ad-oauth)