CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
Apache Airflow logout fails to revoke bearer tokens, leaving them valid until expiry.
28
Vulnerability2 · 1 read
CVE-2026-86473
Logout Fails to Revoke Bearer Tokens in Apache Airflow (CWE-613)
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Airflow's Core API logout endpoint only revokes a session token presented via the _token cookie, so when an API client authenticates with an Authorization bearer header instead, logout returns a success response but revokes nothing. As a result, a bearer token remains valid until natural expiry, which defaults to 24 hours and is configurable. An attacker who has already obtained a copy of a victim's token keeps the victim's level of access even after the victim logs out believing the session has ended; no privileges beyond the victim's own are gained, and stealing the token in the first place is a separate problem outside this issue. Deployments whose automation or clients authenticate to the Airflow API with bearer tokens rather than the browser session cookie are affected. There is no public proof-of-concept, no known exploitation, the flaw is not in the CISA KEV catalog, and CVSS has not yet been scored.
What to do: Upgrade apache-airflow to version 3.3.2 or later, where logout properly handles bearer-token revocation. Until then, reduce the configured token lifetime below the 24-hour default, treat bearer tokens as long-lived secrets (rotate them proactively and on any suspicion of compromise), and audit API logs for token usage after legitimate users have logged out. Restrict network access to the Airflow API so stolen tokens cannot be replayed from the open internet.
| Product | Affected |
|---|---|
| Apache Airflow (apache-airflow) | All versions prior to 3.3.2; fixed in 3.3.2 and later |
Estimated exposure
moderate≈ low-thousands of internet-exposed Airflow instances (public scans typically show on the order of a few thousand exposed Airflow endpoints), with a larger… — Internet-wide scan services (Shodan/Censys) have historically enumerated roughly a few thousand internet-facing Apache Airflow UI/API instances, while most Airflow deployments run inside corporate networks and are not directly exposed;…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable. Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained. Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.