CVE-2024-45033: Apache Airflow FAB Auth Bypass Flaw

CVE-2024-45033 Overview

CVE-2024-45033 is an Insufficient Session Expiration vulnerability [CWE-613] in the Apache Airflow Fab Provider. The flaw affects all releases before version 1.5.2. When an administrator changes a user's password through the Airflow command-line interface (CLI), existing sessions for that account are not invalidated. Authenticated users retain access with their previous session cookies even after the credential rotation. The issue is specific to the CLI code path. Password changes performed through the webserver correctly clear active sessions, so this vulnerability differs from the previously addressed CVE-2023-40273.

Critical Impact
An attacker with a compromised session cookie can maintain persistent access to Apache Airflow even after administrators rotate the account password using the CLI, defeating a standard incident response containment step.

Affected Products

Apache Airflow Fab Provider versions prior to 1.5.2
Apache Airflow deployments using the Flask-AppBuilder (FAB) authentication backend
Airflow environments where operators rotate credentials via the airflow users CLI

Discovery Timeline

2025-01-08 - CVE-2024-45033 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45033

Vulnerability Analysis

Apache Airflow relies on the Fab Provider, a wrapper around Flask-AppBuilder, to handle user authentication and session management. Server-side sessions are tracked in the Airflow metadata database and associated with a signed cookie held by the browser. When a password is rotated, all previously issued sessions should be invalidated so that stolen or shared cookies stop working.

The Fab Provider CLI password-change handler updates the password hash in the user table but does not delete or invalidate that user's active session records. Because the session cookie remains cryptographically valid and its server-side session row is untouched, the authenticated browser continues to satisfy Airflow's authorization checks. An attacker who previously captured a session cookie through phishing, browser compromise, or a shared workstation retains full application access at the victim's privilege level. The scope includes Airflow DAG execution, connection retrieval, and variable access, which frequently contain production credentials.

Root Cause

The root cause is a missing session-invalidation step in the CLI password reset code path. The equivalent webserver flow flushes session state, but the CLI path was not kept in parity with that behavior. This is a classic [CWE-613] Insufficient Session Expiration weakness.

Attack Vector

Exploitation requires that an attacker already hold a valid session cookie for a target Airflow user. The attacker replays the cookie against the Airflow webserver over the network after the administrator has rotated the password with airflow users reset-password or an equivalent CLI command. The server accepts the cookie, and the attacker continues issuing authenticated requests with the pre-rotation privileges. See the upstream fix in Airflow pull request #45139 for the code path involved.

Detection Methods for CVE-2024-45033

Indicators of Compromise

Session cookies observed authenticating a user account after that account's password was rotated via CLI
Airflow webserver access logs showing requests from a source IP address that was used prior to a known credential-rotation event
Unexpected DAG triggers, connection reads, or variable reads by an account recently flagged for compromise

Detection Strategies

Correlate CLI password-reset events in shell history or audit logs with subsequent authenticated webserver activity for the same user
Query the Airflow metadata database for session table entries whose user_id corresponds to accounts with a recent password change
Alert on Airflow API or UI requests made with session identifiers older than the last password-change timestamp for the associated user

Monitoring Recommendations

Forward Airflow webserver access logs and metadata database audit events to a central SIEM for correlation
Track the CLI subcommand airflow users reset-password executions and pair them with automated session cleanup verification
Monitor for anomalous DAG execution patterns, especially trigger events initiated shortly after password rotations

How to Mitigate CVE-2024-45033

Immediate Actions Required

Upgrade the Apache Airflow Fab Provider to version 1.5.2 or later
After any CLI-initiated password change on affected versions, manually purge the session table entries for the impacted user in the Airflow metadata database
Rotate the Flask SECRET_KEY used by Airflow to invalidate all outstanding session cookies across the deployment

Patch Information

The Apache Airflow project resolved the issue in apache-airflow-providers-fab version 1.5.2. The fix ensures the CLI password-reset path clears associated sessions in the same manner as the webserver flow. Details are available in the Apache mailing list announcement and the GitHub pull request #45139.

Workarounds

Perform password changes exclusively through the Airflow webserver until the upgrade is applied, as the webserver path invalidates sessions correctly
Restart the Airflow webserver and rotate SECRET_KEY after any CLI password reset to force reauthentication of all users
Restrict CLI access to a small set of trusted administrators and log all password-management commands for review

bash

# Upgrade the Fab Provider to the fixed release
pip install --upgrade "apache-airflow-providers-fab>=1.5.2"

# Verify the installed version
airflow providers list | grep fab