Apache Airflow Logout Endpoint Silently Ignores Token Revocation Failures: CVE-2026-113508
- Investigating(current)
- Trending(upcoming)
- Workaround available(upcoming)
- Resolved(upcoming)
Executive summary
Apache Airflow's logout endpoint contains a vulnerability where failures during server-side token revocation are silently ignored, causing logout to falsely report success. This occurs particularly on database errors and with tokens from an external issuer.
No verified workaround yet
None of the linked reports describe a mitigation. Follow this incident to hear when one appears.
Official fixThe logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored, allowing tokens to remain valid despite reported logout success.
Evidence
1 report · 1 CVEShow
- [1]CVE First reportApache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation: CVE-2026-113508 (High)(opens security advisory in a new tab)
High severity. Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth]…
by Tenable 0upvotes 0comments
Timeline
- First report on security advisory
Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation: CVE-2026-113508 (High)
Source