CVE-2026-113508

HighCVSS 7.5/10Last modified Nov 12, 2026

Description

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-613

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow	< 3.4.0

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-113515.3The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing u CVE-2026-1135119.1Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree CVE-2026-1135127.8After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the CVE-2026-1135145.5After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could levera CVE-2026-1135167.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren CVE-2026-1135177.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren CVE-2026-1135195.5After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could levera CVE-2026-113527.5An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcur CVE-2026-1135215.5After Effects is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker cou CVE-2026-1135237.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren CVE-2026-1135257.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren CVE-2026-1135268.6After Effects is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the cont