Token Revocation Flaw in Apache Airflow by Apache

CVE-2026-113508

What is CVE-2026-113508?

Apache Airflow contains a vulnerability in its logout endpoint where the revocation of a user's authentication token may fail silently. This issue arises when the logout process redirects to external authentication managers, such as FAB and Keycloak, where a failure in server-side token revocation does not result in a successful logout. As a consequence, users can continue to access the Airflow API with an expired token, especially if the token was issued through a trusted JWKS URL with a token identifier exceeding 32 characters. To mitigate this risk, users are urged to upgrade to Apache Airflow version 3.4.0 or later.

References