CVE-2026-86473
Received Received - Intake

Apache Airflow Bearer Token Session Persistence After Logout

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Apache Software Foundation

Description
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable. Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained. Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-86473
EUVD
EUVD-2026-83945

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apache_airflow 3.3.2
apache airflow to 3.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache Airflow's Core API logout endpoint only revokes session tokens presented as the _token cookie. If a user logs out using an Authorization bearer header instead, the endpoint does not revoke the token, leaving it active until expiration (default 24 hours). An attacker with a copy of the token can retain access even after the victim logs out.

Detection Guidance

This vulnerability cannot be directly detected via commands as it requires verifying the logout behavior of Apache Airflow's API. Check if your Airflow version is below 3.3.2 by running airflow version. If vulnerable, tokens remain valid after logout when using Bearer authentication.

Impact Analysis

If you use Apache Airflow and authenticate with bearer tokens, an attacker who steals your token could maintain access to your account even after you log out. This could lead to unauthorized actions performed under your identity until the token expires.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of user access upon logout, such as GDPR's data protection principles or HIPAA's access control rules. Unauthorized continued access may lead to data breaches or unauthorized processing of personal data.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.2 or later to fix the logout endpoint vulnerability. This ensures all authentication tokens are properly revoked upon logout, including Bearer tokens presented via the Authorization header.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86473. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart