CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

<p>Posted by Vincent Beck on Sep 15</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow FAB provider (apache-airflow-providers-fab) 3.2.0 before 3.9.0<br /> <br /> Description:<br /> <br /> Apache Airflow FAB provider: changing a user&apos;s password through the Admin user-edit PATCH endpoint does not invalidate <br /> that user&apos;s existing database-backed sess