CVE-2025-57735: Apache Airflow JWT Token Not Invalidated on Logout
Summary
CVE-2025-57735: Apache Airflow: Airflow Logout Not Invalidating JWT. Affects airflow versions >= 3.0.0, < 3.2.0. Fixed in 3.2.0. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2025-57735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It allows users to manage complex data pipelines with ease. However, like many web applications, it is susceptible to security vulnerabilities, particularly in how it handles authentication tokens. The specific issue at hand involves the handling of JSON Web Tokens (JWT) during the logout process.
Vulnerability Detail
The vulnerability arises from the fact that when a user logs out of Apache Airflow, the JWT token used for authentication is not invalidated. This oversight can lead to the potential reuse of the token if it has been intercepted by an unauthorized party. The lack of token invalidation poses a significant security risk, as it allows attackers to exploit the session even after a user has logged out. This issue was addressed in Airflow version 3.2, which introduced a mechanism to invalidate tokens upon logout.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually invalidate tokens by implementing a custom logout function that clears the JWT from the client-side storage. This can be done by adding the following JavaScript code to your logout process:
localStorage.removeItem('jwt_token');
sessionStorage.removeItem('jwt_token');
This will help mitigate the risk until an upgrade can be performed.
Conclusion
The vulnerability identified as CVE-2025-57735 in Apache Airflow poses a significant security risk due to the failure to invalidate JWT tokens upon user logout. Users are strongly encouraged to upgrade to version 3.2.0 or later to mitigate this risk. Implementing temporary workarounds can help reduce exposure until an upgrade is feasible.
See every vulnerability recorded for airflow →
FAQ
CVE-2025-57735 is a vulnerability in Apache Airflow that allows JWT tokens to remain valid after a user logs out, potentially leading to unauthorized access.
If you are using Apache Airflow version 3.0.0 or 3.1.x, you are affected by this vulnerability. Upgrading to version 3.2.0 or later will resolve the issue.
The primary risk is that an attacker could reuse an intercepted JWT token to gain unauthorized access to the user's session, compromising sensitive data and operations.
Yes, tools like Vulert can help monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
