Apache Airflow logout token revocation fails open
Apache Airflow logout endpoint fails to revoke tokens when errors occur during server-side revocation.
20
Vulnerability1 · 1 read
CVE-2026-113508
Apache Airflow: Silent logout token revocation failure (external auth)
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow logout endpoint ignores token revocation failures and reports success. Attackers trigger this with pre-logout tokens under FAB/Keycloak managers or long-ID external JWTs via trusted_jwks_url. Attackers gain continued API access until token expiry. All Apache Airflow users are affected.
What to do: Upgrade to Apache Airflow 3.4.0 or later. No workaround available.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Airflow | all versions before 3.4.0 | 3.4.0 |
Estimated exposure
largeNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.
- Weakness
- CWE-613