CVE-2026-86462

CriticalCVSS 9.1/10Last modified Sep 18, 2026

Description

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed.

This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one.

Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-864637.5Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck t CVE-2026-864649.9In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deplo CVE-2026-864656.5Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-tea CVE-2026-864668.1Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_toke CVE-2026-86467Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began i CVE-2026-864695.3A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX tempo CVE-2026-86474.8Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes fu CVE-2026-864719.3An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary CVE-2026-864724.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, CVE-2026-864739.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting CVE-2026-864747.7The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, a CVE-2026-864755.3The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity co