Apache Airflow patches four session-invalidation flaws

Apache Airflow released apache-airflow-providers-fab 3.9.0 and apache-airflow 3.3.2 to fix four flaws (CVE-2026-82311, 86462, 82310, 86473) rated up to 9.8: password reset, admin PATCH edits, account deactivation and Bearer-token logout failed to revoke sessions, so a stolen cookie or token kept working.

• CVE-2026-82311 (9.8): password reset compared a string ID to an integer, deleting no sessions
• CVE-2026-86462 (9.1): the admin PATCH endpoint never called the invalidation helper
• CVE-2026-82310 (7.2): Core API accepted tokens of deactivated accounts
• CVE-2026-86473 (9.1): logout ignored tokens sent in the Authorization header