by Kastro
Paper/Archive/CVE-2025-57735

CVE-2025-57735

Apache Software Foundation Apache Airflow — Apache Airflow: Airflow Logout Not Invalidating JWT

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.9.519 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache Airflow3.0.0 – < 3.2.03.2.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

patchgithub.com/apache/airflow/pull/61339patchgithub.com/apache/airflow/pull/56633advisorylists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98refopenwall.com/lists/oss-security/2026/04/09/16