As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider versions before 3.9.0 fail to invalidate JSON Web Tokens (JWTs) issued to users after their accounts are deactivated. Disabled accounts are correctly blocked from password authentication, but existing Core application programming interface (API) tokens remain valid and can be refreshed to maintain access. This allows deactivated users to retain programmatic access indefinitely.
Why it matters: Organizations running vulnerable Apache Airflow FAB provider versions must patch immediately; deactivated users with issued tokens can maintain API access despite account disablement, bypassing revocation controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
A vulnerability in Apache Airflow FAB provider versions before 3.9.0 allows deactivated user accounts to retain and renew Core application programming interface (API) JSON Web Tokens (JWT), bypassing the intended access revocation. Although password authentication correctly rejects disabled accounts, the Core API continues accepting existing unexpired tokens and permits token renewal. This affects Apache Airflow FAB provider (apache-airflow-providers-fab) 2.0.0 through 3.8.x.
Why it matters: Organizations running Apache Airflow FAB provider before 3.9.0 face the risk that former or disabled employees can maintain API access indefinitely through token renewal, potentially enabling unauthorized data access or system manipulation until patched.
- Source published
- First seen by Cybersecurity Tracker