Threats Tagged 'ghsa-vj39-hwrh-p32g'

CVE-2026-82310 is a vulnerability in the Apache Airflow FAB provider where deactivating a user account does not invalidate previously issued tokens. Although password authentication blocks disabled accounts, the Core API continues to accept existing unexpired tokens and allows them to mint replacements, enabling continued access with the original roles. This affects deployments using Airflow 3 with FAB auth manager and Core API token authentication. Upgrading to version 3.9.0 or later mitigates the issue by rejecting tokens for deactivated accounts.