CVE-2026-48726

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/67289	Issue Tracking Patch
https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx	Mailing List Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-57735	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-01 09:16

Updated : 2026-07-21 19:10

NVD link : CVE-2026-48726

Mitre link : CVE-2026-48726

CVE.ORG link : CVE-2026-48726

JSON object : View

Products Affected

apache

airflow

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-48726", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48726", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T16:03:20.747068Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.2", "versionType": "semver"}], "packageName": "apache-airflow", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-06-01T09:16:20.187", "references": [{"url": "https://github.com/apache/airflow/pull/67289", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-57735", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths."}, {"lang": "es", "value": "Un error en el manejo del cierre de sesi\u00f3n del gestor de autenticaci\u00f3n de Apache Airflow dej\u00f3 v\u00e1lidos los tokens JWT emitidos previamente despu\u00e9s de que el usuario hizo clic en cerrar sesi\u00f3n en la interfaz de usuario: el flujo de cierre de sesi\u00f3n para 'FabAuthManager' y 'KeycloakAuthManager' no alcanz\u00f3 realmente la llamada subyacente a 'revoke_token()', por lo que el JWT sigui\u00f3 siendo aceptado por el servidor API hasta su caducidad natural. Un atacante que posea un JWT emitido previamente para un usuario que ha cerrado sesi\u00f3n podr\u00eda seguir realizando llamadas API autenticadas como ese usuario. Afecta a las implementaciones configuradas con 'FabAuthManager' o 'KeycloakAuthManager' (el error no afecta a SimpleAuthManager). Esta es una brecha residual en la correcci\u00f3n para CVE-2025-57735, que abord\u00f3 la invalidaci\u00f3n del lado de la cookie en PR #57992 / PR #61339 pero no cubri\u00f3 la accesibilidad de 'revoke_token()' del lado del proveedor en las rutas de c\u00f3digo de FAB / Keycloak. Los usuarios que ya actualizaron para CVE-2025-57735 deber\u00edan actualizar adicionalmente a 'apache-airflow' 3.2.2 o posterior para cubrir las rutas de cierre de sesi\u00f3n de FAB / Keycloak."}], "lastModified": "2026-07-21T19:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0893C3AA-26A4-4682-A36C-05E719EB2943", "versionEndExcluding": "3.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}