Airflow FAB Provider CVE-2026-82311

Requires ALL of: (1) the deployment uses the FAB auth manager with [fab] session_backend=database (the secure-cookie backend is explicitly out of scope and unaffected); (2) the attacker has ALREADY obtained a copy of the victim user's valid session cookie through some prior compromise - this flaw grants no initial access; and (3) an administrator or the user runs the supported password-reset command as a containment action. The limiting factors are significant: the database session backend is not the default in all deployments, and successful abuse depends entirely on a pre-existing session-cookie theft, so this is a persistence/containment-bypass issue rather than a standalone remote break-in. Affected: apache-airflow-providers-fab 2.4.2 up to (not including) 3.9.0.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is materially overstated and conflicts with the description. This is CWE-613 (Insufficient Session Expiration): the flaw does not grant an attacker any NEW access - it requires that the attacker ALREADY holds a copy of the victim's session cookie (an out-of-band prior compromise), and then merely fails to evict them when the documented containment action (password reset) is run. It is a failure of a recovery/remediation control, not a remote unauthenticated code-execution or fresh-access primitive, so PR:N/AC:L does not honestly represent the prerequisite of a pre-stolen cookie. Real-world priority is moderate: EPSS is low at 0.19% (9th percentile), there is no CISA KEV listing and no public exploit code, and exploitation is gated on the non-default [fab] session_backend=database configuration plus a completed password-reset. The signals are internally consistent in pointing to a low-urgency, defense-in-depth fix rather than a mass-exploitation threat, despite the inflated base score. Note the CVSS vector claims network/no-auth exploitation while the description makes clear a valid session cookie must already be compromised - verify scoring against the description.

An attacker steals a valid Airflow user's session cookie (e.g. via XSS, network capture, or endpoint compromise). An administrator, treating the incident as contained, runs the supported password-reset command; because the session-cleanup comparison mismatches string vs integer user IDs, the attacker's database-backed session is never deleted and they retain full access as that user. No public exploit code exists, and the attack presupposes the attacker already possesses the victim's session cookie.