---
id: CVE-2026-82311
title: >-
  Apache Airflow FAB provider: resetting a user's password does not delete that
  user's existing database-backed sessions, despite documented behaviour that it
  does
summary: >-
  Apache Airflow FAB provider: resetting a user's password does not delete that
  user's existing database-backed sessions, despite documented behaviour that it
  does. The cleanup compares the string identifier Flask-Login stores in the
  sessi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-613
vendor: apache
product: apache-airflow-providers-fab
affected:
  - 'apache-airflow-providers-fab >= 2.4.2, < 3.9.0'
patched:
  - apache-airflow-providers-fab 3.9.0
published: '2026-09-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T14:28:43.283'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82311'
references:
  - url: 'https://github.com/apache/airflow/pull/72198'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw'
    label: security@apache.org
  - url: >-
      https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org
    label: security@apache.org
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-86462'
    label: security@apache.org
tags:
  - nvd
  - cve.org
epss: 0.00977
epssPercentile: 0.60568
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-17T19:26:29.021619Z'
ingestedAt: '2026-09-16T09:53:11.598Z'
---

## Overview

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not evict them.

Affects deployments using the FAB auth manager with `[fab] session_backend=database`. The trigger is an administrator (or the user) running the supported password-reset command as a containment action after a session cookie has been compromised; the secure-cookie backend is out of scope, as it documents that it cannot centrally delete sessions.

apache-airflow-providers-fab 3.9.0 also fixes CVE-2026-86462, a second, independent route to the same outcome via the Admin user-edit endpoint; a single upgrade closes both.

Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which compares the identifiers consistently.

## Affected

- `apache-airflow-providers-fab >= 2.4.2, < 3.9.0`

## Remediation

Upgrade past the affected range:

- `apache-airflow-providers-fab 3.9.0`