CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-86473?
CVE-2026-86473 is a critical vulnerability in Apache Airflow, published on 21 Sep 2026.
Official description
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable.
Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained.
Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.
Weakness: CWE-613
Which versions are affected by CVE-2026-86473?
2 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | From 3.0.0 | 3.3.2 |
airflow Bitnami | From 3.0.0 | 3.3.2 |
Products include Apache Airflow.
How do I fix CVE-2026-86473?
Upgrade apache-airflow to 3.3.2 or later.
Is CVE-2026-86473 being exploited?
There is no known exploitation of CVE-2026-86473 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Sources
Also known as BIT-airflow-2026-86473, CLEANSTART-2026-QJ23828, GHSA-9cmm-29p3-73gr, PYSEC-2026-3990.