Executive brief
Apache Airflow's FAB authentication provider allows administrators to change user passwords via an API endpoint. When a password is changed this way, the system fails to invalidate the user's existing login sessions. An attacker who previously captured a user's session cookie can continue accessing that account even after the password is reset, defeating the security purpose of a password change.
Technical details
The vulnerability is a session-invalidation bypass in the Admin user-edit PATCH endpoint (`PATCH /auth/fab/v1/users/{username}`) of the apache-airflow-providers-fab library. When a user's password is updated through this endpoint, the code changes the password hash and saves the user record but never calls the session-invalidation helper function that would terminate existing database-backed sessions. An attacker with a previously obtained session cookie can continue using that cookie to authenticate as the victim user after their password is reset. This is a database-backed sessions issue affecting deployments using the FAB auth manager. The fix requires upgrading to apache-airflow-providers-fab 3.9.0 or later, which adds session invalidation to the PATCH endpoint logic.
Affected products
- Apache Airflow FAB provider before 3.9.0
Timeline
- 2026-09-16: disclosed
- 2026-09-09: patched: Fix merged in apache/airflow PR #72657