Security Flaw in Apache Airflow's Auth Manager Affects User Session Management

CVE-2026-48726

What is CVE-2026-48726?

A vulnerability in Apache Airflow's authentication management system allows for previously-issued JWT tokens to remain valid even after a user logs out. This occurs because the logout processes for FabAuthManager and KeycloakAuthManager fail to properly execute the underlying token revocation, leaving access tokens active until their expiration. As a result, malicious actors can exploit this weakness to perform unauthorized API calls on behalf of users who believed they had securely logged out. Upgrading to Apache Airflow 3.2.2 or later is crucial for mitigating this issue, especially for configurations utilizing these auth managers.

References