Description

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable. Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained. Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-21T15:17:32.997Z",
  "pubdate": "2026-09-21T15:17:32.997Z",
  "executiveSummary": "This vulnerability involves an incomplete session termination mechanism within the Apache Airflow Core API logout endpoint. The vulnerability is classified as an improper session invalidation flaw, specifically affecting authentication handling for API clients.\nWhen a user authenticates via an Authorization bearer header, the logout endpoint fails to revoke the associated token, despite returning a successful logout response. This discrepancy leads the user to believe their session has been terminated while the token remains cryptographically valid until its natural expiration.\nThe risk is characterized by an extended window of opportunity for an attacker who has previously intercepted or acquired a valid bearer token. Because the logout operation does not trigger an actual backend invalidation for bearer-authenticated sessions, the attacker retains authorized access to the API until the token naturally expires. By default, this lifetime is 24 hours. The vulnerability requires the attacker to already possess the victim's token, as the flaw does not facilitate token theft, nor does it grant escalation of privileges beyond those already assigned to the compromised credential. This affects all Apache Airflow versions prior to 3.3.2 where bearer authentication is utilized.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic implementation of the Apache Airflow Core API logout endpoint. The authentication management system is designed to identify session state primarily through the '_token' cookie. During the logout process, the backend logic explicitly targets this cookie for revocation, effectively invalidating the session associated with that specific browser-based storage mechanism.\nHowever, the implementation fails to verify or process the state of authentication established via the Authorization bearer header. When an API client provides an Authorization header, the server-side logout function executes the routine associated with successful session termination and returns an HTTP status code indicating success (e.g., 200 OK or 204 No Content), yet it bypasses the function responsible for blacklisting or invalidating the corresponding bearer token in the backend store.\nThe attack flow proceeds as follows: First, an attacker must acquire a valid bearer token through external means, such as network interception, log exposure, or endpoint compromise. Second, the legitimate user performs a logout action through the API, assuming the session is now terminated. Third, because the API endpoint fails to perform server-side revocation of the bearer token, the token remains in a 'valid' state within the authentication provider's registry. Fourth, the attacker continues to utilize the stolen bearer token to make authenticated requests against the Apache Airflow Core API. Since the server does not check for revoked status in this specific logout context, the attacker maintains authorized access with the same permissions as the original user until the token reaches its default 24-hour expiration or is manually rotated by administrative action.\nThis behavior affects any API client authentication flow relying on bearer tokens. The vulnerability is strictly confined to the token management logic within the Core API. No additional network exposure or privilege escalation is required to leverage this flaw, as the attacker is simply abusing a session that should have been invalidated. The lack of comprehensive revocation logic confirms the vulnerability as an authentication state synchronization failure between the API frontend and the underlying credential management system."
}