CVE-2026-86462: Apache Airflow FAB Auth Bypass Vulnerability

CVE-2026-86462 Overview

CVE-2026-86462 affects the Apache Airflow FAB (Flask-AppBuilder) provider when configured with database-backed sessions. Changing a user's password through the Admin user-edit PATCH endpoint fails to invalidate that user's existing sessions. An attacker who already possesses a valid session cookie retains full access as that user after the password change. The password reset does not evict the attacker's session, defeating a core assumption behind credential rotation. This is a separate code path from CVE-2026-82311; deployments that patched that earlier issue remain vulnerable here because the PATCH endpoint never calls the session-invalidation helper. The flaw is tracked as insufficient session expiration [CWE-613].

Critical Impact
An administrator or user rotating a compromised password does not terminate active attacker sessions, allowing continued unauthorized access to the Airflow environment.

Affected Products

Apache Airflow deployments using the FAB auth manager with database-backed sessions
apache-airflow-providers-fab versions prior to 3.9.0
Environments that applied the CVE-2026-82311 fix but did not upgrade the FAB provider

Discovery Timeline

2026-09-16 - CVE-2026-86462 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86462

Vulnerability Analysis

The Apache Airflow FAB provider exposes an Admin user-edit PATCH endpoint that updates user attributes, including passwords. When a password change occurs through this endpoint, the handler updates the credential in the backing database but never invokes the session-invalidation helper that clears database-backed sessions tied to the affected user. Existing session rows remain valid. Any client presenting a previously issued session cookie continues to authenticate successfully. This behavior is classified as insufficient session expiration under [CWE-613].

Root Cause

The root cause is a missing call to the session-invalidation routine in the PATCH code path. CVE-2026-82311 previously corrected an identifier comparison inside the session-invalidation helper itself. That earlier fix only helps callers of the helper. Because the Admin user-edit PATCH handler never calls the helper, patching CVE-2026-82311 does not remediate this issue. The two vulnerabilities are independent routes to the same outcome: password changes that fail to evict active sessions.

Attack Vector

Exploitation requires that the attacker already holds a valid session cookie for the victim account, typically obtained through prior cookie theft, cross-site scripting, or session sniffing. No attacker interaction with the PATCH endpoint is required. The trigger is routine defensive behavior: an administrator or the user rotating the password in response to suspected compromise. Because the session store is not purged, the attacker's cookie continues to authorize API and UI requests against the Airflow environment, preserving access to workflows, connections, and secrets.

See the GitHub Airflow Pull Request and the Apache Mailing List Discussion for maintainer analysis.

Detection Methods for CVE-2026-86462

Indicators of Compromise

Authenticated Airflow requests from a session cookie whose created_at timestamp predates a recent password change for the same user.
Concurrent active sessions for a single user account originating from distinct IP addresses or user agents following a password rotation event.
Audit log entries showing a successful PATCH to the Admin user-edit endpoint with no corresponding session-table deletions for the target user.

Detection Strategies

Query the FAB session table and correlate user_id and session creation time against the ab_user.changed_on password update timestamp.
Alert on any Airflow API call whose bearer session was issued before the associated account's last credential update.
Review reverse-proxy access logs for continued authenticated traffic from IPs that were active immediately before a password reset.

Monitoring Recommendations

Enable Airflow audit logging for the FAB auth manager and forward events to a central SIEM for correlation with identity events.
Track password change events as high-value telemetry and pivot on subsequent session activity for the affected account.
Baseline normal session lifetimes and flag sessions that persist across credential rotations.

How to Mitigate CVE-2026-86462

Immediate Actions Required

Upgrade apache-airflow-providers-fab to version 3.9.0 or later on all Airflow deployments using the FAB auth manager.
After upgrading, manually purge the database-backed session store to invalidate any sessions that may already be under attacker control.
Force a password reset for all accounts believed to have been exposed and confirm that the session table is empty for those users.

Patch Information

Apache maintainers fixed the issue in apache-airflow-providers-fab version 3.9.0. The upstream fix wires the Admin user-edit PATCH handler to call the session-invalidation helper so password changes evict existing database-backed sessions. Deployments that previously applied the CVE-2026-82311 fix must still upgrade to 3.9.0 because that earlier patch corrected the helper but did not address this endpoint. Refer to the GitHub Airflow Pull Request and the CVE-2026-82311 Record for details.

Workarounds

Until the upgrade is applied, perform an out-of-band deletion of all rows from the FAB session table whenever a password is changed.
Restrict the Admin user-edit PATCH endpoint to a narrow set of administrators via reverse-proxy access control lists.
Shorten server-side session lifetimes so that stolen cookies expire quickly even without an explicit invalidation call.

bash

# Upgrade the FAB provider to the fixed release
pip install --upgrade 'apache-airflow-providers-fab>=3.9.0'

# Post-upgrade: purge existing database-backed sessions (PostgreSQL example)
psql -d airflow -c "DELETE FROM session;"