Database/Control plane, storage & DevOps
Airflow: failed token revocation at logout is ignored, so the token stays valid
Impact
The logout endpoint tries to revoke the presented token, ignores any failure, and still reports success. When the auth manager redirects logout to an external URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token. Revocation fails on database errors, and it always fails for tokens from an external issuer accepted via [api_auth] trusted_jwks_url whose token identifier is longer than 32 characters. Anyone holding a copy of the token can keep using the Airflow API until it expires.
Who can reach it
Anyone holding a copy of a user's Airflow API token from before logout, on deployments whose auth manager uses an external logout URL.
What to do
Upgrade apache-airflow to 3.4.0 or later and restart the API server. Short token lifetimes reduce the exposure until then.
References
Related entries
- Gitea: Helm chart upload decompresses without a size limit before the quota check, allowing CPU exhaustionCVE-2026-117677 · Gitea (Helm chart package upload)Unscored
- Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
- Apache Airflow: Connection and Variable secrets stored in cleartext in audit log rowsCVE-2026-50204 · Apache Airflow (audit log / event-log API)Unscored
- DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored
- Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLBCVE-2026-64229 · Linux x86/mm - broadcast TLB flush with PCID disabledUnscored
- Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT): The ccp driver initialised SNP from the SNP_COMMIT ioctlCVE-2026-64309 · Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.