Database/Control plane, storage & DevOps

Apache Airflow: logout does not invalidate the session JWT, so an intercepted token stays usable

CVSS 9.1CVE-2025-57735Control plane, storage & DevOpscurated

Impact

Airflow before 3.2.0 never invalidates the JWT a user authenticated with when that user logs out, so a token captured from a browser, a proxy log or a shared workstation keeps working until it expires on its own. Where Airflow drives the fleet - submitting training jobs, staging datasets, triggering model builds - a replayed token means DAG trigger and edit rights, and in most deployments the ability to run code on workers through a new or modified DAG. The exposure is conditional on the token being obtained in the first place; this is a session-lifetime weakness, not a remote code execution bug, despite the 9.1 score the project assigned.

Who can reach it

Anyone who can obtain a valid Airflow JWT - network interception, a logged proxy, a shared or recycled browser session - and reach the Airflow API server. No credentials needed beyond the stolen token; logging out does not revoke it.

What to do

Upgrade to Airflow 3.2.0 or later, which implements token invalidation at logout, and restart the API server and schedulers. No node drain. On older versions the only mitigations are shortening the JWT lifetime, rotating the signing secret to force-expire outstanding tokens, and keeping the web UI behind TLS and an authenticating proxy.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-57735 https://github.com/apache/airflow/pull/56633 https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98 http://www.openwall.com/lists/oss-security/2026/04/09/16

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.