CVE-2025-57735: Apache Airflow: Airflow Logout Not Invalidating JWT
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57735?
CVE-2025-57735 has a medium severity level due to the potential for token reuse after user logout.
How do I fix CVE-2025-57735?
To fix CVE-2025-57735, upgrade Apache Airflow to version 3.2.0 or later to implement token invalidation on logout.
What versions of Apache Airflow are affected by CVE-2025-57735?
CVE-2025-57735 affects Apache Airflow versions between 3.0.0 and below 3.2.0.
What is the main issue highlighted in CVE-2025-57735?
The main issue in CVE-2025-57735 is that the JWT token is not invalidated upon user logout, which can lead to potential unauthorized access.
What impact does CVE-2025-57735 have on user security?
CVE-2025-57735 could allow an attacker to reuse JWT tokens if they were intercepted before the user's logout.