As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
CVE-2026-82311 affects Apache Airflow FAB provider versions before 3.9.0, where password resets fail to invalidate existing sessions due to a string-to-integer identifier comparison bug. A user whose password is reset retains access through active sessions, contradicting documented behavior that sessions should be cleared.
Why it matters: Operations teams running Apache Airflow FAB provider 2.4.2 to 3.8.x should patch immediately, as compromised or offboarded user accounts may maintain persistent session access despite password changes.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
A vulnerability in Apache Airflow FAB provider versions before 3.9.0 allows password-reset operations to fail in invalidating existing user sessions due to a type mismatch in session comparison logic. When a user's password is reset, the system compares a string session identifier against an integer database identifier, causing the cleanup to always fail and leaving authenticated sessions active.
Why it matters: Administrators using Apache Airflow FAB provider must upgrade to version 3.9.0 or later to ensure that password resets properly terminate compromised sessions, preventing unauthorized access through stale authentication credentials.
- Source published
- First seen by Cybersecurity Tracker