https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:40:44 +0000 https://vulnerability.circl.lu/vuln/cleanstart-2026-qu51579 <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>CVE-2026-86462 affects multiple packages. Apache Airflow FAB provider: changing a user&#39;s password through the Admin user-edit PATCH endpoint does not invalidate that user&#39;s existing database-backed sessions. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>CVE-2026-86462 affects multiple packages. Apache Airflow FAB provider: changing a user&#39;s password through the Admin user-edit PATCH endpoint does not invalidate that user&#39;s existing database-backed sessions. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-qu51579 https://vulnerability.circl.lu/vuln/fkie_cve-2026-86462 <p>Apache Airflow FAB provider: changing a user&#39;s password through the Admin user-edit PATCH endpoint does not invalidate that user&#39;s existing database-backed sessions. An attacker who already holds a copy of the victim&#39;s session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed.</p> <p>This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one.</p> <p>Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.</p> <p>Apache Airflow FAB provider: changing a user&#39;s password through the Admin user-edit PATCH endpoint does not invalidate that user&#39;s existing database-backed sessions. An attacker who already holds a copy of the victim&#39;s session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed.</p> <p>This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one.</p> <p>Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-86462 https://vulnerability.circl.lu/vuln/ghsa-5j5v-7fmw-4hvh <p>Apache Airflow FAB provider: changing a user&#39;s password through the Admin user-edit PATCH endpoint does not invalidate that user&#39;s existing database-backed sessions. An attacker who already holds a copy of the victim&#39;s session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed.</p> <p>This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one.</p> <p>Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.</p> <p>Apache Airflow FAB provider: changing a user&#39;s password through the Admin user-edit PATCH endpoint does not invalidate that user&#39;s existing database-backed sessions. An attacker who already holds a copy of the victim&#39;s session cookie keeps full access as that user after the password change, so the password reset does not evict them. Affects deployments using the FAB auth manager with database-backed sessions; an administrator (or the user themselves) performing a routine password change is the trigger, and no attacker interaction with the endpoint is needed.</p> <p>This is a second, independent route to the outcome addressed by CVE-2026-82311, which corrected an identifier comparison in the session-invalidation helper. That fix does not repair this endpoint, because the PATCH path never calls the helper at all. Deployments that applied the CVE-2026-82311 fix must also upgrade for this one.</p> <p>Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ghsa-5j5v-7fmw-4hvh