CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow's Core API logout endpoint only revokes a session token presented via the _token cookie, so when an API client authenticates with an Authorization bearer header instead, logout returns a success response but revokes nothing. As a result, a bearer token remains valid until natural expiry, which defaults to 24 hours and is configurable. An attacker who has already obtained a copy of a victim's token keeps the victim's level of access even after the victim logs out believing the session has ended; no privileges beyond the victim's own are gained, and stealing the token in the first place is a separate problem outside this issue. Deployments whose automation or clients authenticate to the Airflow API with bearer tokens rather than the browser session cookie are affected. There is no public proof-of-concept, no known exploitation, the flaw is not in the CISA KEV catalog, and CVSS has not yet been scored.