AIKIDO-2026-996543
apache-airflow-providers-fab is vulnerable to Insufficient Session Expiration
91
CVE Score
Critical
Insufficient Session Expiration
TL;DR
The FAB provider's Admin user-edit PATCH endpoint lets an administrator change another user's password without invalidating that user's existing active sessions. A user whose password was changed this way keeps using their prior session token as if nothing happened. This lets a compromised or rotated account remain reachable through a session that a password change was meant to kill. The fix invalidates existing sessions when an admin changes a user's password through this endpoint.
How do I fix this?
Upgrade the apache-airflow-providers-fab library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and rely on an admin-initiated password change to cut off a compromised or departing user's active session.
Package
Versions
3.2.0 - 3.8.1
Fixed in 3.9.0Background info
apache-airflow-providers-fab is vulnerable to Insufficient Session Expiration in versions 3.2.0 - 3.8.1.
Links
Other
airflow.apache.org/docs/apache-airflow-providers-fab/3.9.0/changelog.htmllists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1slists.apache.org/thread/7sr4sggfv5fhhl3qgphcq0rlhg81do1s?users@airflow.apache.org
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.