Affected deployments use Airflow 3 with the FAB auth manager and Core API token authentication. The issue applies when an administrator deactivates an account that remains in the database and has a previously issued token that is still unexpired.
The user needs their own legitimate Core API token issued before their account was deactivated. No token signature forgery or privilege escalation is required.
Yes. Password authentication rejects the disabled account, but an existing unexpired Core API token remains accepted and can be used to mint a replacement token.
The user retains access within the roles already assigned to that account. The described issue does not grant privileges beyond those existing role-scoped permissions.
Upgrade apache-airflow-providers-fab to version 3.9.0 or later. The fixed version rejects tokens that name a deactivated account.