PT-2026-31606 · Apache · Apache Airflow

Anish Giri + 2 · Published 2026-04-09 · Updated 2026-04-13 · CVE-2025-57735

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description Apache Airflow is affected by an issue where JWT tokens remain valid after a user logs out, potentially allowing unauthorized access if the token is intercepted. The JWT token associated with a user's authentication was not invalidated upon logout. This could allow an attacker who intercepts the token to reuse it for unauthorized access.

Recommendations Upgrade to version 3.2.0 or later to resolve this issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BIT-AIRFLOW-2025-57735

CVE-2025-57735

GHSA-C92R-G8J5-VHCX

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/56633 · Patch
• https://github.com/apache/airflow/pull/61339 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2025-57735 · Vendor Advisory
• https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57735 · Security Note
• https://osv.dev/vulnerability/GHSA-c92r-g8j5-vhcx · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://twitter.com/oss_security/status/2042428593897181536 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1sif2hl/top_10_trending_cves_11042026 · Reddit Post
• https://twitter.com/CVEarity/status/2042582724519825666 · Twitter Post
• https://twitter.com/CVEnew/status/2042302838479749123 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/09/16 · Note
• https://twitter.com/pulsepatchio/status/2043163364386353566 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1sif2hj/top_10_trending_cves_11042026 · Reddit Post
• https://twitter.com/cyberbivash/status/2042229368206901511 · Twitter Post