AIKIDO-2026-548054
apache-airflow-providers-fab is vulnerable to Insufficient Session Expiration
98
CVE Score
Critical
Insufficient Session Expiration
TL;DR
The FAB provider's password-reset flow does not delete a user's existing session tokens when their password is reset. A session created before the reset keeps working after the reset, defeating the point of forcing a password change. This lets continued access persist through a token that a reset was meant to revoke. The fix deletes the user's existing sessions as part of the password-reset flow.
How do I fix this?
Upgrade the apache-airflow-providers-fab library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and rely on a password reset to cut off a compromised account's existing session.
Package
Versions
2.4.2 - 3.8.1
Fixed in 3.9.0Background info
apache-airflow-providers-fab is vulnerable to Insufficient Session Expiration in versions 2.4.2 - 3.8.1.
Links
Other
airflow.apache.org/docs/apache-airflow-providers-fab/3.9.0/changelog.htmllists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqwlists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.