CVE-2025-57735
Apache Airflow: Airflow Logout Not Invalidating JWT
Vexday Risk Score
28Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 9.1EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
09 abr 2026Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache AirflowQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →