{"id":"CVE-2025-57735","kind":"vulnerability","aliases":["CVE-2025-57735","GHSA-c92r-g8j5-vhcx"],"related":[],"title":"Apache Airflow: JWT token still valid after logout","description":"When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue.","summary":"Apache Airflow 3.0.0 through 3.1.x did not invalidate a user's JWT token at logout. A token that was intercepted before logout could be reused to act as that user until it expired.","severity":"critical","cvss":9.1,"epss":0.00667,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow","fixed":["3.2.0"],"affected":">= 3.0.0, < 3.2.0","ecosystem":"pypi"},{"name":"apache airflow","fixed":["3.2.0"],"affected":">= 3.0.0, < 3.2.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["airflow","cwe-613","managed-airflow","package","python","self-hosted"],"not_affected_if":["airflow-2.x","version-3.2.0-or-later"],"how_to_check":"- Run `airflow version` or `pip show apache-airflow` and confirm the version is below `3.2.0`.\n- Confirm the installed version is at least `3.0.0` (affected range starts there).","fix":"- Upgrade apache-airflow to `3.2.0` or later (`pip install --upgrade apache-airflow>=3.2.0`).","status":"open","published_at":"2026-04-09T11:16:20+00:00","first_seen_at":"2026-10-26T21:21:58+00:00","triaged_at":"2026-10-26T21:31:58+00:00","updated_at":"2026-10-26T21:55:23+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T21:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade apache-airflow to `3.2.0` or later (`pip install --upgrade apache-airflow>=3.2.0`).","reach":"network","title":"Apache Airflow: JWT tokens stay valid after logout, enabling replay","impact":"medium","summary":"Apache Airflow 3.0.0 through 3.1.x did not invalidate a user's JWT token at logout. A token that was intercepted before logout could be reused to act as that user until it expired.","category":"package","nicknames":[],"who_cares":["airflow","python","self-hosted","managed-airflow"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker reuses an intercepted logged-out token to act as that user","analyst_note":"","how_to_check":"- Run `airflow version` or `pip show apache-airflow` and confirm the version is below `3.2.0`.\n- Confirm the installed version is at least `3.0.0` (affected range starts there).","needs_analyst":false,"not_affected_if":["airflow-2.x","version-3.2.0-or-later"],"who_is_affected":"Teams running Apache Airflow 3.0.x or 3.1.x with the web UI or API where users log in with JWT tokens. The risk depends on whether tokens can be intercepted, so deployments that serve Airflow only over trusted networks with TLS are less exposed. Teams on Airflow 2.x are outside the listed affected range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000608,"input_tokens":3417,"output_tokens":533,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':10A,18A '-57735':11A,19A '-613':27B '3.0.0':38B '3.1':40B '3.2':100C,129C '3.2.0':137C 'act':63B 'airflow':2A,22A,24A,25B,30B,37B,99C,128C 'apach':1A,36B 'apache':21A,23A 'apache-airflow':20A 'authtent':80C 'c92r':14A 'case':94C 'concern':114C 'could':59B,86C 'cve':9A,17A 'cwe':26B 'expir':69B 'fix':139C 'g8j5':15A 'ghsa':13A 'ghsa-c92r-g8j5-vhcx':12A 'host':35B 'implement':102C,106C 'intercept':56B,97C,122C 'invalid':44B,84C,108C 'issu':141C 'jwt':3A,48B,75C 'lead':87C 'log':72C 'logout':8A,51B,58B,110C,117C 'manag':29B 'managed-airflow':28B 'mechan':104C 'packag':31B 'possibl':120C 'python':32B 'recommend':132C 'reus':61B,89C 'scenario':118C 'self':34B 'self-host':33B 'still':5A 'token':4A,49B,53B,76C,92C,107C,124C 'upgrad':126C,134C 'user':46B,66B,71C,78C,111C,130C 'valid':6A 'version':136C 'vhcx':16A 'x':41B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow 3.0.x or 3.1.x with the web UI or API where users log in with JWT tokens. The risk depends on whether tokens can be intercepted, so deployments that serve Airflow only over trusted networks with TLS are less exposed. Teams on Airflow 2.x are outside the listed affected range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-09T11:16:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c92r-g8j5-vhcx","url":"https://github.com/advisories/GHSA-c92r-g8j5-vhcx","severity":"critical","published_at":"2026-04-09T12:31:11+00:00","modified_at":"2026-10-26T21:21:40+00:00","first_seen_at":"2026-10-26T21:21:58+00:00","fetched_at":"2026-10-26T23:28:24+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-57735","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57735","severity":null,"published_at":"2026-04-09T11:16:20+00:00","modified_at":"2026-10-07T09:10:00+00:00","first_seen_at":"2026-10-26T21:55:23+00:00","fetched_at":"2026-10-26T21:55:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}