CVE-2026-82310

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0

Description Deactivating a user account does not invalidate tokens issued to that account prior to the deactivation. While password authentication correctly rejects disabled accounts, the Core API continues to accept existing, unexpired tokens and allows them to mint replacements. This enables an account to maintain role-scoped access indefinitely after an administrator has disabled it by replaying legitimate credentials. This issue occurs in deployments using Airflow 3 with the FAB auth manager and Core API token authentication when an account is deactivated but its record remains in the database.

Recommendations Upgrade to version 3.9.0 or later.