Apache AirflowGHSA-c92r-g8j5-vhcx
Apache Airflow: JWT token still valid after logout
Critical9.1CVE-2025-57735 · Published Apr 9, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 3.0.0, < 3.2.0 | 3.2.0 |
Details and references
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-613
- Also known as
- BIT-airflow-2025-57735, CVE-2025-57735, PYSEC-2026-269
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 9 | Apache Airflow has an authorization bypass in DagRun wait endpoint CVE-2026-34538Medium6.5fixed in 3.2.0 | Medium6.5 | 3.2.0 |
| Apr 13 | Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI CVE-2025-66236Mediumfixed in 3.2.0 | Medium | 3.2.0 |
| Apr 13 | Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API CVE-2026-33858High8.8fixed in 3.2.0 | High8.8 | 3.2.0 |
| Apr 15 | Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access CVE-2026-25219Medium6.5fixed in 3.1.8 | Medium6.5 | 3.1.8 |
| Apr 16 | Apache Airflow: RCE by race condition in example_xcom dag CVE-2025-54550High8.1fixed in 3.2.0 | High8.1 | 3.2.0 |
| Apr 16 | Apache Airflow: JWT token appearing in logs CVE-2026-31987Medium7.5fixed in 3.2.0 | Medium7.5 | 3.2.0 |