An authentication flaw in the Apache Airflow FAB provider allows deactivated users to maintain unauthorized access to the Core API, posing a significant risk to organizational security controls.

This is an instance of insufficient session expiration (CWE-613) where the Core API fails to validate the active status of a user account when presented with a previously issued, unexpired token. An attacker with high privileges (or a compromised account) can continue to access the system and even mint replacement tokens after an administrator has attempted to revoke their access.

The inability to effectively revoke access for compromised or terminated accounts directly undermines the integrity of identity and access management policies. Because the Core API continues to honor tokens linked to disabled accounts, an organization might incorrectly believe an account is contained when it remains fully functional, potentially leading to unauthorized data exposure or malicious internal actions. Given the CVSS score of 7.2, this vulnerability represents a high-risk scenario for environments relying on API-driven workflows.

Immediate Action: Upgrade the apache-airflow-providers-fab package to version 3.9.0 or later to ensure that tokens associated with deactivated accounts are properly rejected.

Proactive Monitoring: Review API access logs for suspicious activity originating from accounts that have been recently deactivated or marked as inactive in the user database.

Compensating Controls: If an immediate upgrade is not feasible, consider implementing stricter token expiration policies or temporarily disabling API access for the affected service until the patch can be applied.

Public Exploit Available: No

This vulnerability highlights a critical failure in session lifecycle management that compromises the efficacy of account suspension procedures. Administrators must prioritize updating the Apache Airflow FAB provider to version 3.9.0 immediately to restore the intended security boundary and ensure that deactivation events result in the total revocation of access.