CVE-2024-45033Low▾ SunlitApache Airflow Fab Provider Insufficient Session Expiration vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.9%
0.9% → 1.0%
Last analysed / modified upstream
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.
This issue affects Apache Airflow Fab Provider: before 1.5.2.
When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from CVE-2023-40273 which was addressed in Apache-Airflow 2.7.0
Users are recommended to upgrade to version 1.5.2, which fixes the issue.
apache-airflow-providers-fab < 1.5.2Upgrade to a patched release:
apache-airflow-providers-fab 1.5.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-46745Medium· 5.3Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability
CVE-2024-42447Medium· 4.2Apache Airflow Providers FAB Insufficient Session Expiration vulnerability
CVE-2026-59245High· 8.1In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently gran…
CVE-2026-82310High· 7.2Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
CVE-2026-86466High· 8.1Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts
CVE-2026-86462Critical· 9.1Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions