CVE-2025-57735

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/56633	Issue Tracking
https://github.com/apache/airflow/pull/61339	Issue Tracking
https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/16	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+. Se recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema.

Information

Published : 2026-04-09 11:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-57735

Mitre link : CVE-2025-57735

CVE.ORG link : CVE-2025-57735

JSON object : View

Products Affected

apache

airflow

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-57735", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57735", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T13:53:16.618977Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.2.0", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-04-09T11:16:20.757", "references": [{"url": "https://github.com/apache/airflow/pull/56633", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/pull/61339", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."}, {"lang": "es", "value": "Cuando el usuario cerr\u00f3 sesi\u00f3n, el token JWT con el que se hab\u00eda autenticado no fue invalidado, lo que podr\u00eda llevar a la reutilizaci\u00f3n de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidaci\u00f3n de tokens al cerrar sesi\u00f3n. Los usuarios que est\u00e9n preocupados por el escenario de cierre de sesi\u00f3n y la posibilidad de interceptar los tokens, deber\u00edan actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.2.0, que corrige este problema."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6", "versionEndExcluding": "3.2.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}