CVE-2026-48726Medium· 6.5▾ SunlitApache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.6%
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoke_token() call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with FabAuthManager or KeycloakAuthManager (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side revoke_token() reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to apache-airflow 3.2.2 or later to cover the FAB / Keycloak logout paths.
apache-airflow < 3.2.2Upgrade to a patched release:
apache-airflow 3.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2022-40189Critical· 9.8OS Command Injection in Apache Airflow
CVE-2022-38649Critical· 9.8OS Command Injection in Apache Airflow
CVE-2023-22884Critical· 9.8Command Injection in Apache Airflow and Apache Airflow MySQL Provider
CVE-2024-41937Medium· 6.1Apache Airflow Cross-site Scripting Vulnerability
CVE-2026-34538Medium· 6.5Apache Airflow has an authorization bypass in DagRun wait endpoint
CVE-2026-22922Medium· 6.5Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access