As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
Apache Airflow versions 3.0.0 before 3.3.2 have a flaw in the Core application programming interface (API) logout endpoint that fails to revoke bearer tokens presented in the Authorization header, only revoking session tokens in cookies. An attacker who obtains a bearer token can continue using it until natural expiration even after a user attempts to log out.
Why it matters: Operators of Apache Airflow deployments are at risk of unauthorized access if a bearer token is compromised, since logout does not invalidate it; patching to version 3.3.2 or later is needed to close this gap.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
CVE-2026-86473 affects Apache Airflow versions 3.0.0 before 3.3.2 and stems from a flaw in the Core logout endpoint that fails to revoke bearer tokens presented via the Authorization header. When users log out with a bearer token instead of a session cookie, the endpoint returns success but leaves the token valid until natural expiry, creating a window for token misuse.
Why it matters: Airflow administrators and developers using bearer token authentication must upgrade to 3.3.2 or later to prevent attackers from exploiting revoked credentials that remain active in the system.
- Source published
- First seen by Cybersecurity Tracker