Live › vulnerability › CVE-2025-57735
Go to dashboardApache Airflow 3.0.0 through 3.1.x did not invalidate a user's JWT token at logout. A token that was intercepted before logout could be reused to act as that user until it expired.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:21 UTC, 1h before NVD. All times on this page are UTC.
Teams running Apache Airflow 3.0.x or 3.1.x with the web UI or API where users log in with JWT tokens. The risk depends on whether tokens can be intercepted, so deployments that serve Airflow only over trusted networks with TLS are less exposed. Teams on Airflow 2.x are outside the listed affected range.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow | pypi | >= 3.0.0, < 3.2.0 | 3.2.0 |
| apache airflow | vendor | >= 3.0.0, < 3.2.0 | 3.2.0 |
airflow version or pip show apache-airflow and confirm the version is below 3.2.0.3.0.0 (affected range starts there).3.2.0 or later (pip install --upgrade apache-airflow>=3.2.0).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2025-57735")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.