Affected deployments use the FAB auth manager with [fab] session_backend=database and apache-airflow-providers-fab versions from 2.4.2 before 3.9.0. Deployments using the secure-cookie session backend are out of scope.
The attacker must already possess a copy of the victim's session cookie. They can continue using that session after the victim or an administrator resets the password because the existing database-backed session is not removed.
No. On affected database-backed-session deployments, the supported password-reset command does not evict the user's existing sessions, despite the documented behavior.
Upgrade apache-airflow-providers-fab to 3.9.0. This upgrade also fixes CVE-2026-86462, an independent issue involving the Admin user-edit endpoint that can lead to the same session-persistence outcome.