{"id":"CVE-2026-113508","kind":"vulnerability","aliases":["CVE-2026-113508"],"related":[],"title":"Apache Airflow: failed logout leaves tokens valid until they expire","description":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.","summary":"Airflow's logout reported success even when the server failed to revoke the token, so a copy of a user's token kept working against the API. Revocation failed on database errors and reliably for externally issued tokens whose identifier is longer than 32 characters, when logout redirects to an external URL such as with the FAB or Keycloak auth managers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-airflow","fab","keycloak","package","self-hosted"],"not_affected_if":["upgraded-to-3.4.0"],"how_to_check":"- Check the installed version with `airflow version` and compare against the fixed release below.\n- Look for `[api_auth] trusted_jwks_url` in the Airflow configuration to see whether external JWT issuers are accepted.\n- Check whether the auth manager redirects logout to an external logout URL (FAB or Keycloak).","fix":"- apache-airflow `3.4.0` or later","status":"open","published_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:44+00:00","updated_at":"2026-11-09T10:26:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T10:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- apache-airflow `3.4.0` or later","reach":"network","title":"Apache Airflow: failed logout leaves tokens valid until they expire","impact":"medium","summary":"Airflow's logout reported success even when the server failed to revoke the token, so a copy of a user's token kept working against the API. Revocation failed on database errors and reliably for externally issued tokens whose identifier is longer than 32 characters, when logout redirects to an external URL such as with the FAB or Keycloak auth managers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-airflow","self-hosted","keycloak","fab"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"a stolen pre-logout token stays usable against the Airflow API","analyst_note":"unknown","how_to_check":"- Check the installed version with `airflow version` and compare against the fixed release below.\n- Look for `[api_auth] trusted_jwks_url` in the Airflow configuration to see whether external JWT issuers are accepted.\n- Check whether the auth manager redirects logout to an external logout URL (FAB or Keycloak).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["upgraded-to-3.4.0"],"who_is_affected":"Teams running Apache Airflow whose auth manager redirects logout to an external URL, such as the FAB or Keycloak auth managers. The reliable failure case needs external tokens accepted via `[api_auth] trusted_jwks_url` with identifiers longer than 32 characters, and database errors can also trigger it. Deployments on earlier versions with no external logout redirect and no trusted JWKS URL have less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000783,"input_tokens":4675,"output_tokens":631,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113508':13A,16A '-2026':12A,15A '3.4.0':206C '32':69B,172C 'accept':159C 'advis':199C 'airflow':2A,19B,26B,88C,144C,192C,205C 'anyon':174C 'apach':1A,18B,87C,204C 'apache-airflow':17B,203C 'api':52B,161C,193C 'attempt':92C 'auth':85B,116C,131C,162C 'charact':70B,173C 'copi':42B,177C 'could':186C 'cve':11A,14A 'databas':56B,149C 'endpoint':91C 'error':57B,150C 'even':31B 'exampl':126C 'expir':10A,196C 'extern':61B,76B,122C,157C 'fab':20B,82B,128C 'fail':3A,35B,54B,147C 'failur':103C 'hold':175C 'host':25B 'identifi':65B,168C 'ignor':108C 'invalid':142C 'issu':62B 'issuer':158C 'jwks':164C 'keep':187C 'kept':48B 'keycloak':21B,84B,130C 'later':208C 'leav':5A 'logout':4A,28B,72B,90C,110C,119C,123C,185C 'longer':67B,170C 'manag':86B,117C,132C 'packag':22B 'present':96C 'redirect':73B,118C 'reliabl':59B,152C 'report':29B,112C 'revoc':53B,105C,136C 'revok':37B,94C 'self':24B 'self-host':23B 'server':34B,100C,134C 'server-sid':133C 'side':135C 'silent':107C 'still':111C 'success':30B,113C 'thing':140C 'token':6A,39B,47B,63B,97C,145C,154C,167C,182C 'trust':163C 'upgrad':201C 'url':77B,124C,165C 'use':188C 'user':45B,180C,197C 'valid':7A 'via':160C 'whose':64B,166C 'work':49B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow whose auth manager redirects logout to an external URL, such as the FAB or Keycloak auth managers. The reliable failure case needs external tokens accepted via `[api_auth] trusted_jwks_url` with identifiers longer than 32 characters, and database errors can also trigger it. Deployments on earlier versions with no external logout redirect and no trusted JWKS URL have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheairflow","fab","keycloak","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-113508':13A,16A '-2026':12A,15A 'airflow':2A 'apach':1A 'cve':11A,14A 'expir':10A 'fail':3A 'leav':5A 'logout':4A 'token':6A 'valid':7A","search_b":"'32':69B 'airflow':19B,26B 'apach':18B 'apache-airflow':17B 'api':52B 'auth':85B 'charact':70B 'copi':42B 'databas':56B 'error':57B 'even':31B 'extern':61B,76B 'fab':20B,82B 'fail':35B,54B 'host':25B 'identifi':65B 'issu':62B 'kept':48B 'keycloak':21B,84B 'logout':28B,72B 'longer':67B 'manag':86B 'packag':22B 'redirect':73B 'reliabl':59B 'report':29B 'revoc':53B 'revok':37B 'self':24B 'self-host':23B 'server':34B 'success':30B 'token':39B,47B,63B 'url':77B 'user':45B 'whose':64B 'work':49B","search_c":"'3.4.0':206C '32':172C 'accept':159C 'advis':199C 'airflow':88C,144C,192C,205C 'anyon':174C 'apach':87C,204C 'apache-airflow':203C 'api':161C,193C 'attempt':92C 'auth':116C,131C,162C 'charact':173C 'copi':177C 'could':186C 'databas':149C 'endpoint':91C 'error':150C 'exampl':126C 'expir':196C 'extern':122C,157C 'fab':128C 'fail':147C 'failur':103C 'hold':175C 'identifi':168C 'ignor':108C 'invalid':142C 'issuer':158C 'jwks':164C 'keep':187C 'keycloak':130C 'later':208C 'logout':90C,110C,119C,123C,185C 'longer':170C 'manag':117C,132C 'present':96C 'redirect':118C 'reliabl':152C 'report':112C 'revoc':105C,136C 'revok':94C 'server':100C,134C 'server-sid':133C 'side':135C 'silent':107C 'still':111C 'success':113C 'thing':140C 'token':97C,145C,154C,167C,182C 'trust':163C 'upgrad':201C 'url':124C,165C 'use':188C 'user':180C,197C 'via':160C 'whose':166C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113508","severity":null,"published_at":"2026-11-09T10:17:05+00:00","modified_at":"2026-11-09T10:17:05+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}