CVE-2026-86462

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0

Description Changing a user password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allows an attacker possessing a victim's session cookie to maintain full access to the account even after a password reset. This issue specifically affects deployments using the FAB auth manager with database-backed sessions. The trigger is a routine password change performed by an administrator or the user, requiring no direct interaction from an attacker with the endpoint.

Recommendations Upgrade to version 3.9.0 or later.