← Zuruck zu CVEs

CVE-2025-57735

CRITICAL

9.1

Beschreibung

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.

CVE Details

CVSS v3.1 Bewertung9.1

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht4/9/2026

Zuletzt geandert4/17/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

apache:airflow

Schwachen (CWE)

CWE-613

Referenzen

https://github.com/apache/airflow/pull/56633(security@apache.org)

https://github.com/apache/airflow/pull/61339(security@apache.org)

https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98(security@apache.org)

http://www.openwall.com/lists/oss-security/2026/04/09/16(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.