CVE-2026-86473 json
Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
published 2026-09-21 49 d ago modified 2026-11-03 6 d ago also BIT-airflow-2026-86473 , EUVD-2026-83945 , PYSEC-2026-3990
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable.
Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained.
Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.
Patch / fix
- bitnami airflow 3.3.2
- pypi apache-airflow 3.3.2
- Apache Software Foundation Apache Airflow 3.3.2
- github.com/apache/airflow#72649 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 48 d ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | airflow | >=3.0.0, <3.3.2 |
3.3.2 |
| pypi | apache-airflow | >=3.0.0, <3.3.2 |
3.3.2 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/apache/airflow/pull/72649
patch, issue-tracking, vendor-advisory, advisory, report
-
lists.apache.org
/thread/k9z1p0q1ng8m68nlnv9d1fqzscrfm7vr
vendor-advisory, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/09/21/5
mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-86473
web
Sources
- CVE List CVE-2026-86473
- NVD CVE-2026-86473
- OSV BIT-airflow-2026-86473
- OSV PYSEC-2026-3990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.