Apache Airflow logout token revocation fails open
Original title: CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed
Apache Airflow logout endpoint fails to revoke tokens when errors occur during server-side revocation.
Apache Airflow's logout endpoint attempts to revoke the presented token on the server, but any failure during revocation is silently ignored and logout still reports success. This affects the auth manager redirects logout to an external logout URL. The issue is present in versions before 3.4.0. The disclosure does not indicate active exploitation.
- Affects Apache Airflow before 3.4.0
- Logout token revocation fails silently
- Severity low
Impact: logout token not properly revoked
| Product | Affected |
|---|---|
| Apache Airflow | before 3.4.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113508 | Apache Airflow: Silent logout token revocation failure (external auth) | — | — |
From the original article
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3. 4. 0 Description: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.