CVE-2026-113508 · Package
NO FIX YET · SEE WHAT TO DO
Airflow's logout reported success even when the server failed to revoke the token, so a copy of a user's token kept working against the API. Revocation failed on database errors and reliably for externally issued tokens whose identifier is longer than 32 characters, when logout redirects to an external URL such as with the FAB or Keycloak auth managers.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Apache Airflow whose auth manager redirects logout to an external URL, such as the FAB or Keycloak auth managers. The reliable failure case needs external tokens accepted via [api_auth] trusted_jwks_url with identifiers longer than 32 characters, and database errors can also trigger it. Deployments on earlier versions with no external logout redirect and no trusted JWKS URL have less exposure.
Not affected if upgraded-to-3.4.0
Who cares apache-airflow, fab, keycloak, self-hosted
airflow version and compare against the fixed release below.[api_auth] trusted_jwks_url in the Airflow configuration to see whether external JWT issuers are accepted.3.4.0 or laterApache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via [api_auth] trusted_jwks_url whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.