CVE-2025-57735: Apache Airflow JWT Token Not Invalidated After Logout
Summary
CVE-2025-57735: Apache Airflow: JWT token still valid after logout. Affects apache-airflow versions >= 3.0.0, < 3.2.0. Fixed in 3.2.0. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2025-57735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and automating tasks. Airflow's architecture allows for dynamic pipeline generation, providing users with a robust framework for managing workflows. However, it has been identified that prior to version 3.2.0, the system did not invalidate JWT tokens upon user logout, posing a security risk.
Vulnerability Detail
The vulnerability arises from the failure to invalidate JWT tokens when a user logs out of Apache Airflow. This oversight allows an attacker to reuse an intercepted token, potentially gaining unauthorized access to the system. The issue is particularly concerning in scenarios where tokens may be intercepted during transmission, leading to unauthorized actions being performed under the guise of the legitimate user. The vulnerability is classified under CWE-613, indicating an issue with improper authorization.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as using HTTPS to encrypt token transmission and regularly rotating tokens to minimize the risk of interception. However, the best practice is to upgrade to the patched version.
Conclusion
The vulnerability identified as CVE-2025-57735 in Apache Airflow poses a significant security risk due to the failure to invalidate JWT tokens upon user logout. Users are strongly advised to upgrade to version 3.2.0 or later to ensure proper token management and enhance the security of their workflows.
See every vulnerability recorded for apache-airflow →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
If you do not upgrade, your application remains vulnerable to token reuse attacks, which could lead to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
While upgrading is the best solution, you can mitigate risks by using HTTPS and implementing token rotation.
JWT, or JSON Web Token, is a compact, URL-safe means of representing claims to be transferred between two parties. In Apache Airflow, it is used for secure user authentication.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
