← Vulnerability feed

Vulnerability record · CVE-2024-42447 · published 5 August 2024

CVE-2024-42447: Apache-airflow-providers-fab insufficient session expiration vulnerability

Apache · Apache Airflow Providers Fab

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.  Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.

9.8 CVSS 3.1 Critical EPSS 0.93% · top 41.0% CWE-613 · Insufficient session expiration
9.8CVSS 3.1 base score
0.93%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.  Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/airflow/pull/40784 Issue TrackingPatch
https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52 Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2024/08/04/2

Track CVE-2024-42447 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-82311Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour …EPSS 0.98%9.8CVE-2026-59243Apache-airflow-providers-fab improper verification of cryptographic signature vulnerabilityThe FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or…EPSS 0.64%9.1CVE-2026-86462Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-…EPSS 0.83%9.1CVE-2026-75156Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deploymen…EPSS 0.38%8.1CVE-2026-86466Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it acce…EPSS 0.37%8.1CVE-2026-59245Apache-airflow-providers-fab improper privilege management vulnerabilityIn the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resour…EPSS 0.60%8.1CVE-2024-45033Apache-airflow-providers-fab insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user…EPSS 0.95%7.2CVE-2026-82310Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication cor…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2024-42447), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.