CVE-2026-113508

Full vulnerability record from the local CVENow database.

Description

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-09 10:17:05.463000

Last modified

2026-11-09 11:17:20.670000

View original CVE JSON

{
  "id": "CVE-2026-113508",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-09T10:17:05.463",
  "lastModified": "2026-11-09T11:17:20.670",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.python.org",
          "packageName": "apache-airflow-core",
          "packageURL": "pkg:pypi/apache-airflow-core",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.4.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/73562",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apache/airflow/pull/73788",
      "source": "[email protected]"
    },
    {
      "url": "https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/11/09/20",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}