[<prev] [next>] [day] [month] [year] [list]
Message-ID: <420b5d11-1567-9039-beed-24ba87e9f6d7@apache.org>
Date: Sun, 31 May 2026 12:17:29 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-48726: Apache Airflow: revoke_token() unreachable in
FabAuthManager / KeycloakAuthManager logout path
Severity: Moderate
Affected versions:
- Apache Airflow (apache-airflow) before 3.2.2
Description:
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths.
Credit:
Bernardo Curi (r3ngar_bugado) (finder)
pierrejeambrun (remediation developer)
References:
https://github.com/apache/airflow/pull/67289
https://www.cve.org/CVERecord?id=CVE-2025-57735
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-48726
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
