As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider versions before 3.9.0 contain a flaw where administrative password changes via the PATCH endpoint do not invalidate existing database-backed sessions. An attacker with a copied session cookie retains full user access after the password is changed.
Why it matters: Airflow operators and administrators must upgrade to 3.9.0 or later to prevent attackers who have obtained session cookies from maintaining unauthorized access despite password resets.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
CVE-2026-86462 is a vulnerability in Apache Airflow FAB provider versions 3.2.0 before 3.9.0 where the admin password change endpoint does not invalidate existing database-backed sessions. An attacker with a stolen session cookie retains full user access even after the victim changes their password.
Why it matters: Teams using Apache Airflow FAB provider must upgrade to 3.9.0 or later, as session hijacking attacks remain effective after password resets without this patch.
- Source published
- First seen by Cybersecurity Tracker