airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +36 more potentially affected by CVE-2025-57735 via apache-airflow (>=3.0.0, <=3.2.0rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =1.28.0 and more Source cves: CVE-2025-57735 Source advisory: OSV:PYSEC-2026-269...

CVE-2025-57735

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario...

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

GHSA-VR7M-C6V4-8CX8 Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

PYSEC-2026-187

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

PT-2026-45379

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description A bug in the authentication manager logout handling allows previously issued JSON Web Tokens JWT to remain valid after a user logs out via the user interface. In deployments configured with...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +36 more potentially affected by CVE-2025-57735 via apache-airflow (>=3.0.0, <=3.2.0rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =1.28.0 and more Source cves: CVE-2025-57735 Source advisory: OSV:GHSA-C92R-G8J5-VHCX...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +36 more potentially affected by CVE-2025-57735 via apache-airflow (>=3.0.0, <=3.2.0rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0, =1.28.0 and more Source cves: CVE-2025-57735 Source advisory: GHSA-C92R-G8J5-VHCX...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +37 more potentially affected by CVE-2025-57735 via apache-airflow-core (>=3.0.0rc2, <=3.1.8)

apache-airflow-core PYPI version =3.0.0rc2, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0rc1, =1.28.0 and more Source cves: CVE-2025-57735 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-15954280...

CVE-2025-57735

The Apache Airflow auth manager contains a vulnerability where JWT tokens issued for user authentication remain valid after a user logs out. This occurs because the logout flow for FabAuthManager and KeycloakAuthManager fails to reach the underlying revoke_token() call, allowing an attacker with ...