When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.
After a user logged out of the system, the server did not invalidate the previously issued JWT token (CWE-613: insufficient session expiration). The token remained valid for its entire original lifetime. An attacker who intercepted the token (e.g., through network sniffing, log leaks, or other methods) could use it to authenticate on behalf of the logged-out user. The token invalidation mechanism upon logout was introduced only in Apache Airflow version 3.2.
An attacker possessing an intercepted JWT token can gain unauthorized access to the system with the privileges of the original user, threatening the confidentiality and integrity of data and workflow configurations (DAGs) managed by Airflow.
Apache Airflow should be updated to version 3.2.0 or newer, which introduces a JWT token invalidation mechanism upon logout. Until the update is performed, it is recommended to minimize exposure of the Airflow interface to untrusted networks and to implement short JWT token lifetimes if this can be configured.
Apache Airflow in versions prior to 3.2.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NApache Airflow
APPApache3.0.0 – 3.2.0 (excl.)
Related vulnerabilities
Apache Airflow — brak uwierzytelnienia w Experimental API umożliwia RCE
Apache Airflow: RCE przez niebezpieczną deserializację DAG (CWE-502)
Apache Airflow: command injection przez niebezpieczny wzorzec w dokumentacji BashOperator
Apache Airflow Providers FAB — nieprawidłowe wygasanie sesji (CWE-613)
Apache Airflow – błąd przełączania kontekstu uprawnień przed wersją 2.6.0