GHSA-c92r-g8j5-vhcx: Apache Airflow: Airflow Logout Not Invalidating JWT

Q: Who is exposed to token reuse after logout?

Users authenticated with JWTs are exposed if an attacker intercepts a token before or around logout. The intercepted token may be reused because logout did not invalidate it.

Q: What version addresses the logout token invalidation issue?

Airflow 3.2 implements token invalidation at logout. Users are recommended to upgrade to version 3.2.0 or later.

Q: What should teams prioritize if they cannot upgrade immediately?

The provided information identifies concern specifically around the logout scenario and the possibility of token interception. Prioritize reducing the opportunity for JWTs to be intercepted until an upgrade to 3.2.0 or later can be completed.

Published Apr 9, 2026

Updated

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Affected Software

1 affected component

Apache Airflow<3.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Airflow to a version that resolves this vulnerability.
Fixed in 3.2.0

Event History

Apr 9, 2026

CVE Published

via OSV·11:12 AM

Data Sourced

via OSV·11:12 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to token reuse after logout?

Users authenticated with JWTs are exposed if an attacker intercepts a token before or around logout. The intercepted token may be reused because logout did not invalidate it.

What version addresses the logout token invalidation issue?

Airflow 3.2 implements token invalidation at logout. Users are recommended to upgrade to version 3.2.0 or later.

What should teams prioritize if they cannot upgrade immediately?

The provided information identifies concern specifically around the logout scenario and the possibility of token interception. Prioritize reducing the opportunity for JWTs to be intercepted until an upgrade to 3.2.0 or later can be completed.

GHSA-c92r-g8j5-vhcx: Apache Airflow: Airflow Logout Not Invalidating JWT

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to token reuse after logout?

What version addresses the logout token invalidation issue?

What should teams prioritize if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to token reuse after logout?

What version addresses the logout token invalidation issue?

What should teams prioritize if they cannot upgrade immediately?