Search: CVE-2026-86462

Apache Airflow FAB provider versions 3.2.0 through 3.8.x have a vulnerability where changing a user's password via the Admin user-edit PATCH endpoint does not invalidate existing database-backed sessions. This allows an attacker with a stolen session cookie to maintain access even after the password is changed. The issue affects deployments using the FAB auth manager with database-backed sessions and requires no attacker interaction with the password change endpoint. The vulnerability is fixed in version 3.9.0 and later.