CVE-2022-41672: 
Apache Airflow vulnerability analysis and mitigation

In Apache Airflow versions prior to 2.4.1, a security vulnerability was identified where deactivating a user account would not prevent an already authenticated user from continuing to use the UI or API. The vulnerability was discovered by Axel Chong (@Haxatron) and was assigned CVE-2022-41672 (Openwall, Debian Tracker).

The vulnerability is classified under CWE-613 (Session Fixation) and affects the authentication mechanism in Apache Airflow. When an administrator deactivates a user account, the system failed to invalidate existing sessions, allowing deactivated users to maintain access to both the user interface and API endpoints (NVD).

The vulnerability could allow deactivated users to retain unauthorized access to the Airflow system, potentially compromising system security and maintaining access to sensitive operations and data through both the UI and API interfaces (Openwall).

The vulnerability was addressed in Apache Airflow version 2.4.1. Users are advised to upgrade to this version or later to receive the security fix. The fix implements proper session management that ensures user sessions are terminated when accounts are deactivated (Openwall).