Executive brief
Apache Airflow is an open-source platform used to schedule and monitor complex workflows. A security flaw was found where users who log out of the system might still have active session tokens (JWTs) that remain valid until they naturally expire. This could allow an attacker who has obtained a recently used token to continue accessing the system and performing actions as that user even after they intended to end their session.
Technical details
An insufficient session expiration vulnerability (CWE-613) exists in Apache Airflow's authentication management. The logout flow for `FabAuthManager` and `KeycloakAuthManager` contains a logic error where the `/auth/logout` endpoint returns early if a logout URL is provided, bypassing the `revoke_token()` call. Consequently, JSON Web Tokens (JWTs) remain valid on the API server until their natural expiration. An attacker with access to a previously issued JWT can continue to make authenticated API calls. This issue is a residual gap from a previous fix and is resolved in version 3.2.2 by ensuring token revocation occurs before any redirect or early return.
Affected products
- Apache Software Foundation Apache Airflow < 3.2.2
Timeline
- 2026-05-22: patched: Fix merged into main branch
- 2026-06-01: disclosed: Initial advisory publication
- 2026-07-08: advisory: Advisory updated and reviewed