VulnSocial

CVE-2026-82310(apache / apache-airflow-providers-fab)

LOWCVSS 7.2 Ā· HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement ā€” so the account keeps its role-scoped access indefinitely after an administrator has disabled it. The user replays their own legitimate credential; no signature forgery or privilege escalation is involved, and the access stays within the roles the account already held. Affects deployments using Airflow 3 with the FAB auth manager and Core API token authentication, where an administrator deactivates an account whose row remains in the database and whose previously issued token has not expired. The trigger is administrative deactivation as a containment action, which silently fails to contain. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which rejects tokens naming a deactivated account.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-613

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • apache-airflow-providers-fab

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Affected systems

Vendors
apache
Products
apache-airflow-providers-fab

Deep dive

Activity timeline1 mentions / 1d
00111Mentions Ā· 2026-10-16: 110-16
Full discourse1 post
  • Hossted@Hossted_OSS

    5 vulnerabilities that kept security teams busy in October. In October 2026, five foundational infrastructure tools got hit with vulnerabilities that standard monitoring would not have caught: šŸ”“ #Kubernetes (CVE-2026-92574): security context bypass allowed users with pod creation privileges to break out of container boundaries. šŸ”“ #Redis (CVE-2026-92925): improper input validation in the cluster bus packet parser enabled remote denial of service and potential code execution. šŸ”“ #ApacheActiveMQ (CVE-2026-101292): unsafe reflection flaw allowed unauthenticated remote attackers to execute arbitrary shell commands. šŸ”“ #ApacheAirflow (CVE-2026-82310): token validation failure allowed deactivated accounts to retain indefinite access to pipelines. šŸ”“ #ApacheZooKeeper (CVE-2026-59969): TLS hostname verification bypass left cluster traffic vulnerable to man-in-the-middle attacks. A green status indicator means the service is running. It does not mean it is secure. šŸ‘‡ CVE breakdown and patch details in the first comment. #DevOps #DevSecOps #Kubernetes #CyberSecurity #AppSec #OpenSource #Hossted

    1000032
    218 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheapache-airflow-providers-fab---

Explore more

Back to dashboardapache CVEsapache-airflow-providers-fab vulnerabilities