CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
AI summary · grok-4.7Summaries by Vani AI
Apache Airflow logout fails to revoke bearer tokens, leaving them valid until expiry.
CVE-2026-86473 is a low-severity flaw in Apache Airflow 3.0.0 before 3.3.2. The Core API logout endpoint revokes only a session token presented as the _token cookie. When the same credential is presented in an Authorization bearer header, logout returns a normal response but revokes nothing, leaving the token valid until expiry. The notice does not report exploitation in the wild.
Key facts
- Low-severity flaw in Airflow 3.0.0 before 3.3.2.
- Logout revokes only the _token session cookie.
- A bearer credential is not revoked on logout.
- A copied token stays valid until expiry.
- CVEs
- CVE-2026-86473
- Vendors
- Apache
- Products
- Apache Airflow
- Organizations
- Apache
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86473 | Logout Fails to Revoke Bearer Tokens in Apache Airflow (CWE-613) | 9.1 | — |
From the original article
Posted by Rahul Vats on Sep 21 Severity: low Affected versions: - Apache Airflow 3. 0. 0 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.