PUBLISHED
2026-06-01 09:16
MODIFIED
2026-06-01 09:16
EPSS (Prob. Exploit)
0.38%
Top 67.8%
> DESCRIPTION
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-613: DEPRECATED: Insufficient Session Expiration - This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
> GITHUB SECURITY ADVISORY
GHSA-vr7m-c6v4-8cx8
MODERATE
Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout
AFFECTED PACKAGES:
PIP / apache-airflow
< 3.2.2
Fixed in: 3.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path
AFFECTED PACKAGES:
Unknown / Unknown
8238 versions affected
ALIASES:
BIT-airflow-2026-48726, GHSA-vr7m-c6v4-8cx8, PYSEC-2026-187
> HISTORIQUE DES MODIFICATIONS
Première apparition
01/06/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-613: Insufficient Session Expiration - According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization....
Nouvelle valeur:
CWE-613: DEPRECATED: Insufficient Session Expiration - This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants.
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-613: Insufficient Session Expiration - According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization....
Total des modifications: 2
Dernière mise à jour: 6 days ago