SecurityFan score 21 · Tier C
CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed
The Brief
- Apache Airflow's logout endpoint tried to revoke the presented token on the server, but failures during revocation were silently ignored.
- Logout still reported success even when revocation failed.
- Affected versions are Apache Airflow before 3.4.0.
Why it matters
Operators relying on server-side logout to invalidate sessions may believe a token is revoked when it is still valid after logout.
Who’s affected
- Teams running Apache Airflow before 3.4.0
What to do
- Upgrade Apache Airflow to 3.4.0 or later
- Apache Airflow 3.4.0
- CVE-2026-113508
- #apache-airflow
- #authentication
- #security
- #vulnerability
- #logout
Posted by Rahul Vats on Nov 08 Severity: low Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported…
Timeline
Vulnerability posted to oss-security by Rahul Vats
Open Source Security
CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed