Apache Airflow: JWT Token weiterhin gültig nach Logout

Successful exploitation of this vulnerability allows an attacker to impersonate a legitimate user and execute tasks within the Airflow environment. This could lead to unauthorized data access, modification, or deletion. The attacker could trigger DAGs, access sensitive configuration information, and potentially compromise the entire Airflow cluster. The blast radius extends to all resources accessible by the impersonated user, potentially impacting downstream systems and data.

Organizations heavily reliant on Apache Airflow for data orchestration and workflow automation are particularly at risk. Environments with weak network security or where users frequently access Airflow from untrusted networks are also more vulnerable. Shared hosting environments where multiple users share an Airflow instance should be prioritized for patching.

• python / airflow: Check Airflow version using airflow version. If ≤3.2.0rc2, the system is vulnerable. • python / airflow: Monitor Airflow logs for unusual activity or unauthorized DAG runs. • generic web: If Airflow is exposed externally, monitor network traffic for suspicious JWT token activity using network intrusion detection systems (NIDS).

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2025-08-18
2. Veröffentlicht2026-04-09
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2025-57735 is to upgrade to Apache Airflow version 3.2.0 or later. If upgrading is not immediately feasible, consider implementing stricter token management policies, such as shortening token expiration times. Monitor Airflow logs for suspicious activity and implement intrusion detection systems to identify potential token reuse attempts. After upgrading, verify token invalidation at logout by logging out and attempting to reuse a previously obtained token.