Airflow FAB provider: password reset fails to evict existing sessions, so a stolen cookie keeps working

Impact

With the FAB auth manager and [fab] session_backend=database, resetting a user's password is documented to drop that user's existing sessions, but the cleanup compares Flask-Login's string identifier against the integer database id, so it never matches and no session is deleted. The practical consequence is that the standard containment action after a stolen Airflow session cookie does not contain anything: whoever holds the cookie keeps acting as that user - triggering DAGs, reading connections, editing pipeline code paths - while the operator believes access was revoked. On a GPU fleet where Airflow schedules training and data movement, that is a false sense of having closed an incident.

Who can reach it

An attacker who already holds a copy of a victim's Airflow session cookie. No new access is gained by this flaw; it defeats the revocation step. Deployments using the secure-cookie backend are out of scope, since that backend documents that it cannot delete sessions centrally.

What to do

Upgrade apache-airflow-providers-fab to 3.9.0 or later, which compares the identifiers consistently; the same release also fixes CVE-2026-86462, an independent route to the same outcome through the Admin user-edit endpoint. Provider package upgrade plus a webserver restart. Until then, contain a compromised session by deleting the user's rows from the session table directly or rotating the Airflow secret key, rather than relying on the password reset.

References

Related entries

• Linux nfsd: async server-side COPY registers a stateid pointing into a reused request bufferCVE-2026-89676 · Linux NFS server (nfsd, s2s_cp_stateids IDR for async COPY)Critical
• Linux nfsd: filehandle composed from a stale dentry when dentry_create returns a different dentryCVE-2026-89677 · Linux NFS server (nfsd4_create_file, fh_compose on the wrong dentry)Critical
• Linux nfsd: pNFS layout fence worker takes a duplicate reference and leaks the layout stateidCVE-2026-89681 · Linux NFS server (nfsd pNFS layout fence worker, lm_breaker_timedout)Critical
• Linux nfsd: LAYOUTGET racing a delegation revoke hits a BUG_ON and panics the NFS serverCVE-2026-89686 · Linux NFS server (nfsd4_alloc_layout_stateid, fi_deleg_file under fi_lock)Critical
• Linux nfsd: seqid_op replay retry drops a stateowner reference it never tookCVE-2026-89688 · Linux NFS server (nfs4_preprocess_seqid_op, stateowner refcount on replay retry)Critical
• Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply dataCVE-2026-89689 · Linux NFS server (nfsd4_sequence session slot shrinker, free_session_slots)Critical