---
id: "CVE-2025-57735"
kind: "vulnerability"
aliases: ["CVE-2025-57735", "GHSA-c92r-g8j5-vhcx"]
title: "Apache Airflow: JWT token still valid after logout"
severity: "critical"
cvss: 9.1
epss: 0.00667
exploited: false
status: "open"
category: "package"
products: [{"name": "apache-airflow", "fixed": ["3.2.0"], "affected": ">= 3.0.0, < 3.2.0", "ecosystem": "pypi"}, {"name": "apache airflow", "fixed": ["3.2.0"], "affected": ">= 3.0.0, < 3.2.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["airflow", "cwe-613", "managed-airflow", "package", "python", "self-hosted"]
not_affected_if: ["airflow-2.x", "version-3.2.0-or-later"]
published_at: "2026-04-09T11:16:20+00:00"
first_seen_at: "2026-10-26T21:21:58+00:00"
updated_at: "2026-10-26T21:55:23+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c92r-g8j5-vhcx", "first_seen_at": "2026-10-26T21:21:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57735", "first_seen_at": "2026-10-26T21:55:23+00:00"}]
---

# Apache Airflow: JWT token still valid after logout

Apache Airflow 3.0.0 through 3.1.x did not invalidate a user's JWT token at logout. A token that was intercepted before logout could be reused to act as that user until it expired.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apache-airflow affected >= 3.0.0, < 3.2.0 fixed 3.2.0
- vendor:apache airflow affected >= 3.0.0, < 3.2.0 fixed 3.2.0

## How to check

- Run `airflow version` or `pip show apache-airflow` and confirm the version is below `3.2.0`.
- Confirm the installed version is at least `3.0.0` (affected range starts there).

## Fix

- Upgrade apache-airflow to `3.2.0` or later (`pip install --upgrade apache-airflow>=3.2.0`).

## Timeline

- 2026-10-26T21:21:58+00:00 ghsa https://github.com/advisories/GHSA-c92r-g8j5-vhcx
- 2026-10-26T21:55:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-57735

## From the sources

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+



Users are recommended to upgrade to version 3.2.0, which fixes this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_