{"api_version":"1","generated_at":"2026-11-10T07:51:30+00:00","cve":"CVE-2026-113508","urls":{"html":"https://cve.report/CVE-2026-113508","api":"https://cve.report/api/cve/CVE-2026-113508.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-113508","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-113508"},"summary":{"title":"Apache Airflow: Logout token revocation fails open; errors silently swallowed","description":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-09 10:17:05","updated_at":"2026-11-09 11:17:20"},"problem_types":["CWE-613","CWE-613 CWE-613: Insufficient Session Expiration"],"metrics":[],"references":[{"url":"https://github.com/apache/airflow/pull/73788","name":"https://github.com/apache/airflow/pull/73788","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/apache/airflow/pull/73562","name":"https://github.com/apache/airflow/pull/73562","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/20","name":"http://www.openwall.com/lists/oss-security/2026/11/09/20","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no","name":"https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113508","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113508","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Airflow","version":"affected 3.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Claude Security Scans","lang":"en"},{"source":"CNA","value":"Pierre Jeambrun","lang":"en"},{"source":"CNA","value":"Jarek Potiuk","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-09T10:09:46.244Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"http://www.openwall.com/lists/oss-security/2026/11/09/20"}],"title":"CVE Program Container"}],"cna":{"affected":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"tool","value":"Claude Security Scans"},{"lang":"en","type":"remediation developer","value":"Pierre Jeambrun"},{"lang":"en","type":"remediation developer","value":"Jarek Potiuk"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later."}],"value":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later."}],"metrics":[{"other":{"content":{"text":"low"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613: Insufficient Session Expiration","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T09:46:14.168Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["patch"],"url":"https://github.com/apache/airflow/pull/73562"},{"tags":["patch"],"url":"https://github.com/apache/airflow/pull/73788"},{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no"}],"source":{"discovery":"INTERNAL"},"title":"Apache Airflow: Logout token revocation fails open; errors silently swallowed","x_generator":{"engine":"airflow-s/generate_cve_json.py"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-113508","datePublished":"2026-11-09T09:46:14.168Z","dateReserved":"2026-10-20T10:56:16.168Z","dateUpdated":"2026-11-09T10:09:46.244Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-09 10:17:05","lastModifiedDate":"2026-11-09 11:17:20","problem_types":["CWE-613","CWE-613 CWE-613: Insufficient Session Expiration"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"113508","Ordinal":"1","Title":"Apache Airflow: Logout token revocation fails open; errors silen","CVE":"CVE-2026-113508","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"113508","Ordinal":"1","NoteData":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.","Type":"Description","Title":"Apache Airflow: Logout token revocation fails open; errors silen"}]}}}