CVE-2026-48726: Apache Airflow JWT Token Revocation Bypass in FAB and Keycloak Logout

Technical summary

The vulnerability exists in Apache Airflow's `FabAuthManager` and `KeycloakAuthManager` implementations, which do not properly invoke the underlying `revoke_token()` method during logout. While the prior CVE-2025-57735 fix addressed cookie invalidation through PRs #57992 and #61339, it did not remediate the token revocation logic in the authentication provider code paths. When a user initiates logout via the UI, the JWT remains in the API server's accepted token list until its natural expiry window closes. SimpleAuthManager is not affected. The vulnerability requires an authenticated or previously-authenticated user and does not involve network-level complexity—standard JWT bearer tokens can be replayed post-logout.

Business impact

An attacker who captures or maintains a copy of a logged-out user's JWT token can continue to impersonate that user for API automation, data exfiltration, or workflow manipulation until token expiry (often hours or days). For organizations running DAG-heavy Airflow instances or using Airflow API for mission-critical scheduling, this creates a window of unauthorized access that may go undetected if audit logs are incomplete. Compliance frameworks (SOC 2, HIPAA, PCI-DSS) typically require session termination to be immediate; this gap violates those expectations.

Affected systems

Only Apache Airflow deployments explicitly configured with `FabAuthManager` or `KeycloakAuthManager` are vulnerable. The vulnerability does not affect deployments using SimpleAuthManager. Any Airflow 2.x or 3.x version prior to 3.2.2 that uses one of the affected authentication managers is in scope. Organizations running air-gapped or internal Airflow instances with either of these auth backends should treat this as urgent; externally-exposed Airflow instances with these auth types are at elevated risk.

Exploitability

Exploitability is straightforward if an attacker has obtained a user's JWT token (through social engineering, application logs, memory dumps, or network interception before logout). No new authentication is required once the token is captured—standard API calls using the Bearer token will succeed. However, the attack requires a precondition: either an attacker must capture the token before logout, or a user must be socially engineered into sharing it. The attack surface is primarily internal (API consumers, automation scripts) unless Airflow APIs are exposed to untrusted networks. The CVSS score of 6.5 (MEDIUM) reflects the requirement for prior low-privilege authentication plus the high confidentiality impact if tokens are compromised.

Remediation

Upgrade to Apache Airflow 3.2.2 or later. If you previously patched CVE-2025-57735, this additional upgrade is necessary to close the FAB and Keycloak logout code paths. Organizations unable to upgrade immediately should implement network-level token revocation by rotating or invalidating JWTs at the Keycloak or identity provider level on logout, or by temporarily blocking known-compromised token IDs at the API gateway. Monitor API call patterns post-logout for anomalies (e.g., automation continuing under a user's ID after they clock out).

Patch guidance

Apply Apache Airflow 3.2.2 or any later 3.x version. Verify your current version with `airflow version`. If you are on 2.x, check with your vendor for backported patches or plan a timeline for upgrade to 3.2.2 LTS. Test the logout flow in a staging environment to confirm tokens are properly revoked—inspect API logs to ensure no requests succeed with invalidated bearer tokens post-logout. If using Keycloak, also verify that your Keycloak token revocation endpoint is reachable and configured in your Airflow environment variables.

Detection guidance

Search your API access logs for Bearer token reuse after a user's recorded logout timestamp. Cross-reference logout events (typically in Airflow's security or UI audit logs) with subsequent API calls using the same Authorization header. Implement alerting for any API calls that arrive after a user's logout event in the same session or from the same token ID. Network-based detection: look for JWT tokens in your proxy or WAF logs that are being replayed beyond their expected session lifetime. If using Keycloak or FAB, enable token revocation audit logging at the provider level.

Why prioritize this

Although the CVSS score is MEDIUM, this vulnerability is a **regression** or incomplete fix for a prior critical session management issue (CVE-2025-57735). Organizations that already deployed patches for the previous CVE should prioritize this follow-up immediately to prevent security control bypass. Token-stealing attacks are common in Airflow environments because DAGs and automation often embed credentials or tokens. The logical next step for an attacker who has captured a token is to use it after the victim logs out—this vulnerability directly enables that attack path.

Risk score, explained

CVSS 6.5 reflects: (1) Network-accessible API (AV:N), (2) Low attack complexity with standard token replay (AC:L), (3) Requirement for low-level authenticated or previously-authenticated context (PR:L), (4) No user interaction needed for the attack itself (UI:N), (5) Unauthorized scope unchanged (S:U), (6) High confidentiality impact (C:H) due to continued API access as a privileged user, and (7) No integrity or availability impact during the token window (I:N, A:N). The score does not escalate to HIGH because it requires preconditions (token capture) and is time-bound by token expiry, but it should not be underestimated in environments where DAGs contain secrets or access sensitive data.

Frequently asked questions