CVE-2026-48726 json
Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path
published 2026-06-01 5 mo ago modified 2026-11-03 6 d ago also BIT-airflow-2026-48726 , EUVD-2026-33581 , GHSA-vr7m-c6v4-8cx8 , PYSEC-2026-187
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths.
Patch / fix
- pypi apache-airflow 3.2.2
- bitnami airflow 3.2.2
- Apache Software Foundation Apache Airflow 3.0.0, 3.2.2
- github.com/apache/airflow#67289 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | <3.2.2 |
3.2.2 |
| bitnami | airflow | <3.2.2 |
3.2.2 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/apache/airflow/pull/67289
patch, web, issue-tracking
-
lists.apache.org
/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx
vendor-advisory, web, mailing-list, advisory
-
cve.org
/CVERecord?id=CVE-2025-57735
related, web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-48726
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-187.yaml
web
-
github.com
/advisories/GHSA-vr7m-c6v4-8cx8
advisory
Sources
- CVE List CVE-2026-48726
- GitHub Advisory GHSA-vr7m-c6v4-8cx8
- NVD CVE-2026-48726
- OSV BIT-airflow-2026-48726
- OSV PYSEC-2026-187
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.