Advisoriesby IbisApache AirflowGHSA-c92r-g8j5-vhcx
Apache Airflow: JWT token still valid after logout
Fix: upgrade to 3.2.0 or later
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 3.0.0, < 3.2.0 | 3.2.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-613
- Also known as
- BIT-airflow-2025-57735, CVE-2025-57735, PYSEC-2026-269
- nvd.nist.gov/vuln/detail/CVE-2025-57735
- github.com/apache/airflow/pull/56633
- github.com/apache/airflow/pull/61339
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-269.yaml
- lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98
- pypi.org/project/apache-airflow
- www.openwall.com/lists/oss-security/2026/04/09/16
More Apache Airflow advisories
All Apache Airflow
Apache Airflow: JWT token appearing in logsCVE-2026-31987fixed in 3.2.0Apache Airflow: RCE by race condition in example_xcom dagCVE-2025-54550fixed in 3.2.0Apache Airflow: information disclosureCVE-2026-25219fixed in 3.1.8Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APICVE-2026-33858fixed in 3.2.0Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UICVE-2025-66236fixed in 3.2.0Apache Airflow has an authorization bypass in DagRun wait endpointCVE-2026-34538fixed in 3.2.0