# CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/600) · 2026-11-09 · Security
Page: https://themorning.dev/story/cve-2026-113508-apache-airflow-logout-token-revocation-fails-open-errors-silentl-49b30f6b8221e8d3
Kind: security · Impact: low

## In brief

- Apache Airflow's logout endpoint tried to revoke the presented token on the server, but failures during revocation were silently ignored.
- Logout still reported success even when revocation failed.
- Affected versions are Apache Airflow before 3.4.0.

## Why it matters

Operators relying on server-side logout to invalidate sessions may believe a token is revoked when it is still valid after logout.

## What to do

- Upgrade Apache Airflow to 3.4.0 or later

## Versions

- Apache Airflow 3.4.0

## CVEs

- CVE-2026-113508

## Timeline

- 2026-11-08: Vulnerability posted to oss-security by Rahul Vats

## Coverage

- [CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed](https://seclists.org/oss-sec/2026/q4/600) — Open Source Security, 2026-11-09

Tags: apache-airflow, authentication, security, vulnerability, logout

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev