https://seclists.org/oss-sec/2026/q4/600: CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed
Published Nov 9, 2026
·Updated
Affected Software
1 affected component
Apache Airflow<3.4.0
Anyone who possesses a copy of a user's token from before logout can continue using it against the Airflow API until the token expires, if server-side revocation fails.
Server-side revocation is the only mechanism that invalidates the Airflow token when the auth manager redirects logout to an external logout URL, such as with the FAB or Keycloak auth managers. Tokens issued by an external issuer accepted through [api_auth] trusted_jwks_url reliably encounter this issue when their token identifier exceeds 32 characters.
The provided advisory recommends upgrading to Apache Airflow 3.4.0 or later. It does not provide a workaround or mitigation for affected earlier versions.