← Vulnerability feed

Vulnerability record · CVE-2024-45033 · published 8 January 2025

CVE-2024-45033: Apache-airflow-providers-fab insufficient session expiration vulnerability

Apache · Apache Airflow Providers Fab

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from  CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9  which was addressed in Apache-Airflow 2.7.0 Users are recommended to upgrade to version 1.5.2, which fixes the issue.

8.1 CVSS 3.1 High EPSS 0.95% · top 40.2% CWE-613 · Insufficient session expiration
8.1CVSS 3.1 base score
0.95%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from  CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9  which was addressed in Apache-Airflow 2.7.0 Users are recommended to upgrade to version 1.5.2, which fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/airflow/pull/45139 Issue Tracking
https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st Mailing ListVendor Advisory

Track CVE-2024-45033 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-82311Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour …EPSS 0.98%9.8CVE-2026-59243Apache-airflow-providers-fab improper verification of cryptographic signature vulnerabilityThe FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or…EPSS 0.64%9.8CVE-2024-42447Apache-airflow-providers-fab insufficient session expiration vulnerabilityInsufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with…EPSS 0.93%9.1CVE-2026-86462Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-…EPSS 0.83%9.1CVE-2026-75156Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deploymen…EPSS 0.38%8.1CVE-2026-86466Apache-airflow-providers-fab origin validation error vulnerabilityApache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it acce…EPSS 0.37%8.1CVE-2026-59245Apache-airflow-providers-fab improper privilege management vulnerabilityIn the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resour…EPSS 0.60%7.2CVE-2026-82310Apache-airflow-providers-fab insufficient session expiration vulnerabilityApache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication cor…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2024-45033), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.