Apache Airflow FAB CVE-2026-86462

Requires ALL of: (1) the deployment uses the apache-airflow-providers-fab FAB auth manager configured with database-backed sessions (not the default signed-cookie/other backends); (2) the attacker already possesses a valid copy of the victim's session cookie obtained through a prior, separate compromise; and (3) a password change is performed via the Admin user-edit PATCH endpoint (the trigger, done by an admin or the user, not the attacker). Limiting factors: exploitation depends entirely on prior session-cookie theft, so this is a post-compromise persistence/containment failure rather than an initial access vector; the database-session configuration is a non-default gate; and the affected version window is 3.2.0 to <3.9.0.

Signals conflict sharply between the vendor's rating and the real-world preconditions. The vendor CVSS 3.1 vector (9.1, AV:N/AC:L/PR:N/UI:N) portrays a remote, unauthenticated, trivial attack, but the description makes clear this is a session-invalidation/containment failure: the attacker must ALREADY hold a copy of the victim's session cookie (obtained via a prior compromise, XSS, network capture, etc.), and the deployment must be running the FAB auth manager with database-backed sessions. No attacker action against the PATCH endpoint is needed - the trigger is a routine password change by an admin or the user. That makes PR:N/AC:L misleading: there is a hard prerequisite (pre-stolen cookie) plus a non-default configuration gate, which I judge as AC:H, lowering my independent score to roughly 8.1. Corroborating the low urgency: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code is identified. This is a legitimate defense-in-depth/containment weakness (the password reset fails to evict a compromised session), not a mass-exploitable remote entry point. It is a real priority specifically for organizations doing incident response - where the assumption 'we changed the password, they're out' is false - but it is NOT a widespread drive-by risk. Note also this is the SECOND independent route to the same outcome as CVE-2026-82311; deployments that applied the 82311 fix are still vulnerable because that fix corrected a helper this PATCH path never calls.

An attacker previously captured a victim's Airflow session cookie (e.g. via XSS, log exposure, or network interception) on a deployment using the FAB auth manager with database-backed sessions. When the victim or an administrator later changes the password through the Admin user-edit PATCH endpoint - believing this evicts any intruder - the existing DB-backed session is never invalidated, so the attacker's stolen cookie keeps authenticating them with full access as that user. No public exploit code is identified, and the attacker needs no interaction with the endpoint itself.