Apache CVE-2026-82310

CRITICAL

2026-09-15

Privilege Escalation Apache

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:15 vuln.today

CVE Published

Sep 15, 2026 - 19:56 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News We need answer only title. Need concise SEO-friendly. Format: "Critical/High [Vulnerability Type] in [Product] - [CVE-ID]". Product Apache? More specifically Apache Airflow FAB auth provider. Vulnerability type: Authentication Bypass? Deactivated accounts continue via JWT. Maybe "Critical Authentication Bypass in Apache Airflow FAB Provider - CVE-2026-82310". Max 100 chars. Need no quotes. Let's craft. Ensure product maybe Apache Airflow. Title: "Critical Authentication Bypass in Apache Airflow F Sep 16, 2026

AnalysisAI

Deactivated user accounts in the Apache Airflow FAB auth provider (apache-airflow-providers-fab 2.0.0 before 3.9.0) keep working through the Airflow 3 Core API: the password login path correctly rejects a disabled account, but any JWT access token issued before deactivation is still accepted and can be exchanged for a fresh token indefinitely. The result is that an administrative deactivation — typically performed as a containment action against a departing employee or compromised account — silently fails, leaving the account with its original role-scoped access to the Airflow control plane. …