https://seclists.org/oss-sec/2026/q3/851: CVE-2026-86473: Apache Airflow: Logout ignos a psented Authorization bear token, leaving it vocable only by expiry

Q: Which deployments are exposed to this issue?

Apache Airflow versions 3.0.0 before 3.3.2 are affected when API clients authenticate using an Authorization bearer token. Browser-style sessions that present the token through the _token cookie are not the affected logout path.

Q: What must an attacker have to benefit from the flaw?

The attacker must already possess a valid copy of the victim's bearer token. The issue does not provide a way to obtain a token or grant privileges beyond those of the token's owner.

Q: What happens after an affected user logs out?

The logout endpoint returns its normal response but does not revoke a bearer token supplied in the Authorization header. A copied token can therefore remain valid until it expires; the default lifetime is 24 hours, though it is configurable.

Q: What should teams do if they use bearer-token API clients?

Upgrade to Apache Airflow 3.3.2 or later. If an immediate upgrade is not possible, treat logout as insufficient to invalidate potentially exposed bearer tokens and account for the configured token expiration period.

Published Sep 21, 2026

Updated

Affected Software

1 affected component

Apache Airflow<3.3.2

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Airflow versions 3.0.0 before 3.3.2 are affected when API clients authenticate using an Authorization bearer token. Browser-style sessions that present the token through the _token cookie are not the affected logout path.

What must an attacker have to benefit from the flaw?

The attacker must already possess a valid copy of the victim's bearer token. The issue does not provide a way to obtain a token or grant privileges beyond those of the token's owner.

What happens after an affected user logs out?

The logout endpoint returns its normal response but does not revoke a bearer token supplied in the Authorization header. A copied token can therefore remain valid until it expires; the default lifetime is 24 hours, though it is configurable.

What should teams do if they use bearer-token API clients?

Upgrade to Apache Airflow 3.3.2 or later. If an immediate upgrade is not possible, treat logout as insufficient to invalidate potentially exposed bearer tokens and account for the configured token expiration period.