Apache Airflow: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.1
  CVE-2025-57735

  Apache Airflow: Airflow Logout Not Invalidating JWT

  When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who a…

  Apache Software Foundation Apache Airflow apache-airflow airflow-3 Wolfi PyPI
  Apr 9, 2026
• Medium 6.5
  CVE-2026-34538

  Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)

  Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protecte…

  Apache Software Foundation Apache Airflow apache-airflow airflow-3 Wolfi PyPI
  Apr 9, 2026

Revision history

1. 2026-04-09 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-c92r-g8j5-vhcx vom 2026-04-09
  https://github.com/advisories/GHSA-c92r-g8j5-vhcx
• GitHub Security Advisory GHSA-C92R-G8J5-VHCX vom 2026-04-09
  https://github.com/advisories/GHSA-C92R-G8J5-VHCX