CVE-2026-82311: Apache Airflow FAB Auth Bypass Vulnerability

CVE-2026-82311 Overview

CVE-2026-82311 affects the Apache Airflow Flask-AppBuilder (FAB) provider when deployed with the database session backend. Resetting a user's password does not invalidate that user's existing database-backed sessions, contradicting documented behaviour. The cleanup routine compares the string identifier stored by Flask-Login against the user's integer database identifier, so the comparison never matches and no session record is removed. An attacker who already holds a copy of a victim's session cookie retains authenticated access as that user after the password change. This weakness maps to insufficient session expiration [CWE-613].

Critical Impact
A password reset intended to evict a compromised session leaves the attacker's stolen cookie fully valid, defeating the primary containment action for account takeover.

Affected Products

Apache Airflow FAB provider (apache-airflow-providers-fab) versions prior to 3.9.0
Deployments using the FAB auth manager with [fab] session_backend=database
Not affected: FAB deployments using the secure-cookie session backend (documented as unable to centrally delete sessions)

Discovery Timeline

2026-09-16 - CVE-2026-82311 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82311

Vulnerability Analysis

The Apache Airflow FAB provider ships a supported password-reset command that administrators (or users) run as a containment step after a session cookie is suspected compromised. The command is documented to delete the target user's active database-backed sessions in addition to changing the password. In vulnerable releases, the deletion routine iterates stored sessions and compares each session's _user_id value against the user's database primary key. Flask-Login serializes _user_id as a string, while the database identifier is an integer. The equality check therefore always evaluates false, and no rows are removed from the sessions table.

The attacker requirement is possession of a valid session cookie for the target account. Because the underlying session record remains in the database and the cookie signature remains valid, the compromised session continues to authenticate requests after the password change completes.

A related bug tracked as CVE-2026-86462 reaches the same outcome through the Admin user-edit endpoint. Both defects are addressed by upgrading to apache-airflow-providers-fab 3.9.0.

Root Cause

The root cause is a type-mismatched identifier comparison. Flask-Login stores the user identifier in the session as a string, but the FAB session-cleanup logic compares that value directly against an integer column from the users table. Python's equality operator returns false across these types, so the query that should target the victim's sessions matches nothing. Version 3.9.0 normalizes both sides of the comparison to the same type.

Attack Vector

Exploitation requires the adversary to already hold a valid session cookie for the victim, typically acquired through cookie theft, cross-site scripting, malware, or an interception of transport. The victim or an administrator then performs the documented password reset expecting it to terminate all active sessions. Because the cleanup silently no-ops, the attacker continues issuing authenticated requests with the stolen cookie until the session's own expiration is reached or the record is manually removed.

The vulnerability is described in prose in the upstream advisory; see the Apache Mailing List Discussion and the GitHub Pull Request for Airflow for the corrective code change.

Detection Methods for CVE-2026-82311

Indicators of Compromise

Successful authenticated Airflow requests from a session cookie whose associated user recently completed a password reset.
Persistent rows in the FAB session table for a user account after the password-reset command reports success.
Source IP addresses or user-agents for a given account that do not change across a password-reset event.

Detection Strategies

Correlate password-reset events in Airflow audit logs with subsequent authenticated activity carrying pre-reset session cookies.
Query the FAB session backend for records tied to accounts that have executed a password reset and flag any that were not deleted.
Alert on Airflow API or web UI actions performed by a user account within a short window before and after a password change, focusing on identical session identifiers.

Monitoring Recommendations

Ingest Airflow web server access logs and FAB session-store metadata into a centralized logging or SIEM platform for correlation.
Track the [fab] session_backend configuration value across environments to identify deployments in scope for this issue.
Monitor the version of apache-airflow-providers-fab installed on schedulers and web servers, and alert on releases prior to 3.9.0.

How to Mitigate CVE-2026-82311

Immediate Actions Required

Upgrade apache-airflow-providers-fab to version 3.9.0 or later on all Airflow web server and scheduler nodes.
Manually delete all rows in the FAB session store for any account known or suspected to have had its cookie compromised.
Rotate the Flask session signing secret (SECRET_KEY) to invalidate every existing signed session cookie in the deployment.
Force reauthentication for all users after upgrading to confirm no stale sessions remain.

Patch Information

Apache released apache-airflow-providers-fab 3.9.0, which normalizes identifier types in the session-cleanup comparison so the password-reset command deletes the target user's database-backed sessions as documented. The same release also fixes the related CVE-2026-86462 issue in the Admin user-edit endpoint. Review the GitHub Pull Request for Airflow for the exact code change.

Workarounds

Switch the FAB auth manager to session_backend=securecookie and rotate SECRET_KEY to invalidate signed cookies, accepting the documented limitation that secure-cookie backends cannot centrally delete sessions.
After any password reset on a vulnerable version, manually truncate or delete the affected user's rows from the FAB session table.
Reduce the configured session lifetime so any residual sessions expire quickly following a reset.

bash

# Configuration example
pip install --upgrade 'apache-airflow-providers-fab>=3.9.0'

# After upgrade, invalidate all existing signed session cookies
# by rotating the Flask SECRET_KEY used by the Airflow webserver
export AIRFLOW__WEBSERVER__SECRET_KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')"

# Restart Airflow webserver so the new key takes effect
airflow webserver --restart