CVE-2026-48726 Details
Description
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths.
A vulnerability in Apache Airflow's authentication managers, FabAuthManager and KeycloakAuthManager, allowed previously-issued JSON Web Tokens (JWT) to remain valid after a user logged out. The logout process did not properly invoke the token revocation function, leaving the JWT accepted by the API server until it naturally expired. This issue could be exploited by an attacker with access to a JWT of a logged-out user, enabling them to make authenticated API calls as that user. The vulnerability affects Apache Airflow versions prior to 3.2.2.
Users should upgrade to Apache Airflow version 3.2.2 or later to address this vulnerability. Instructions for upgrading can be found in the Apache Airflow documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apache/airflow/pull/67289 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx | [email protected] | Mailing ListVendor Advisory |
| https://www.cve.org/CVERecord?id=CVE-2025-57735 | [email protected] | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | < 3.2.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |