Vulnerability · low
Apache Airflow logout token revocation fails open, errors swallowed (CVE-2026-113508)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apache Airflow installations before 3.4.0 using server-side logout
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Airflow to 3.4.0 or later
The Brief
- Apache Airflow's logout endpoint tried to revoke the presented token on the server, but failures during revocation were silently ignored.
- Logout still reported success even when revocation failed.
- Affected versions are Apache Airflow before 3.4.0.
Why it matters
Operators relying on server-side logout to invalidate sessions may believe a token is revoked when it is still valid after logout.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Airflow is a workflow orchestrator that data and ops teams build with and run. |
| No | Core infrastructure | Judgment: Airflow is a single widely used framework, not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Airflow is a widely used mainstream data-engineering orchestration platform. |
| No | Exploited in the wild | oss-security post (Nov 2026) describes only the logout flaw; no source reports observed attacks. |
| No | Public exploit | oss-security post gives a description and advisory only; no source mentions published exploit code or PoC. |
| No | Remote, no login | oss-security post does not say the flaw is reachable without credentials; sources do not state this. |
| No | Full takeover | oss-security post describes logout token revocation failing silently; no code execution or privilege escalation is reported. |
| No | Secrets exposed | oss-security post reports no stolen or exposed credentials, tokens, or data; only a revocation error is described. |
| No | Supply chain | oss-security post describes a normal bug in legitimate Airflow code; no compromised package or pipeline is reported. |
| No | No fix yet | oss-security post lists affected versions as before 3.4.0, implying a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability posted to oss-security by Rahul Vats
Open Source Security
CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed
Source
CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided