Airflow FAB provider: password change through the Admin PATCH endpoint does not evict existing sessions

Impact

Changing a user's password through the Admin user-edit PATCH endpoint leaves that user's database-backed sessions valid. An attacker holding a stolen session cookie keeps full access as that user after the reset, so the standard incident response for a compromised Airflow account - rotate the password - does not actually remove the intruder. That matters on a GPU fleet because the Airflow account can hold DAG-editing or connection-editing rights, which are a path to code execution on workers and, in some configurations, on the scheduler. This is a second, independent route to the outcome addressed by CVE-2026-82311: that fix corrected an identifier comparison in the session-invalidation helper, but the PATCH path never calls the helper, so deployments that applied it are still exposed.

Who can reach it

Remote attacker who already holds a copy of a victim's Airflow session cookie. No interaction with the vulnerable endpoint is needed by the attacker - the routine password change by an admin or the user themselves is the trigger. Affects deployments using the FAB auth manager with database-backed sessions.

What to do

Upgrade apache-airflow-providers-fab to 3.9.0 or later and restart the webserver / API server. Applying the CVE-2026-82311 fix alone is not sufficient. For any account suspected compromised before upgrading, purge its rows from the session table directly rather than relying on the password change. Package upgrade plus a daemon restart.

References

Related entries

• AMD EPYC / Ryzen - Hardware Validated Boot enforcement: Hardware Validated Boot is not properly enforced, so anCVE-2018-8930 · AMD EPYC / Ryzen - Hardware Validated Boot enforcementCritical
• AMD EPYC Server - protected memory region access control: Insufficient access control over protected memory regions onCVE-2018-8933 · AMD EPYC Server - protected memory region access controlCritical
• PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigation: Non-uniform Rowhammer patterns triggered bit flips on every oneCVE-2021-42114 · PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigationCritical
• Digi RealPort protocol (Digi console/terminal servers): RealPort is the protocol Digi console servers use to exposeCVE-2023-4299 · Digi RealPort protocol (Digi console/terminal servers)Critical
• Ivanti Connect Secure: Stack-based buffer overflowCVE-2025-0282 · Ivanti Connect SecureCritical
• Ivanti Connect Secure/ZTA: Stack-based buffer overflowCVE-2025-22457 · Ivanti Connect Secure/ZTACritical