PYSEC-2024-265 CVE-2024-42447 GHSA-62qf-qm3g-fvcw PYSEC-2026-1146

Apache Airflow Providers FAB Insufficient Session Expiration vulnerability

Critical PyPI

Severity: 0.0 / 10; Critical · CVSS 4.0
Exploit chance (EPSS): 0.93%; Chance of exploitation in the next 30 days. Higher than 60.58% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-613 Insufficient Session Expiration
Fix: 1.2.2; Upgrade apache-airflow-providers-fab to this version or later

Description

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.

This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.

FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)
FAB provider 1.2.0 affected all versions of Airflow.

Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.

Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.

Also upgrading Apache Airflow to latest version available is recommended.

Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.

Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.

Affected versions

PyPI

Package	Vulnerable	Fixed in
apache-airflow	`<= 1.2.1` `<= 1.2.0`	No fix yet
apache-airflow-providers-fab	`>= 1.2.0, < 1.2.2`	`1.2.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

apache-airflow-providers-fab PyPI → `1.2.2`

pip

pip install --upgrade "apache-airflow-providers-fab>=1.2.2"

poetry

poetry add "apache-airflow-providers-fab>=1.2.2"

uv

uv add "apache-airflow-providers-fab>=1.2.2"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: Passive
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-613: Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

How to prevent it

Implementation: Set sessions/credentials expiration date.

References

Advisories

Packages

Timeline

Aug 5, 2024 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
CVE-2020-13927 Authentication bypass in Apache Airflow	Critical Known exploited	Also affects apache-airflow
CVE-2020-11978 Remote code execution (RCE) in Apache Airflow	High Known exploited	Also affects apache-airflow
PYSEC-2026-3990 Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie.	Critical	Also affects apache-airflow
PYSEC-2026-3989 When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie…	Medium	Also affects apache-airflow
PYSEC-2026-3988 Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is…	Medium	Also affects apache-airflow
GHSA-5247-m8w9-2v4m Apache Airflow missing team context permits cross-team Dag actions and XCom reads	Medium	Also affects apache-airflow
GHSA-f3c2-j7g8-vpp8 Apache Airflow Task SDK fails to mask list-shaped JSON Variables	Medium	Also affects apache-airflow
GHSA-cjv4-7hp2-2x9h Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext	Medium	Also affects apache-airflow

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor