CyberRota Analysis
AI-GeneratedApache Airflow's FAB provider is vulnerable due to a flaw where deactivating a user account does not invalidate previously issued tokens, allowing continued access through those tokens even after the account has been disabled. This issue could lead to unauthorized access, as the Core API accepts unexpired tokens for deactivated accounts, enabling users to maintain their role-scoped access indefinitely. Organizations using Airflow 3 with the FAB auth manager should prioritize upgrading to version 3.9.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a replacement — so the account keeps its role-scoped access indefinitely after an administrator has disabled it. The user replays their own legitimate credential; no signature forgery or privilege escalation is involved, and the access stays within the roles the account already held. Affects deployments using Airflow 3 with the FAB auth manager and Core API token authentication, where an administrator deactivates an account whose row remains in the database and whose previously issued token has not expired. The trigger is administrative deactivation as a containment action, which silently fails to contain. Users of apache-airflow-providers-fab are recommended to upgrade to version 3.9.0 or later, which rejects tokens naming a deactivated account.
Related CVEs
Other vulnerabilities affecting the same vendor(s)