PT-2026-31606

CVE-2025-57735

Published

2026-04-09

Updated

2026-06-29

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0

Description Apache Airflow is affected by an issue where JWT tokens remain valid after a user logs out, potentially allowing unauthorized access if the token is intercepted. The JWT token associated with a user's authentication was not invalidated upon logout. This could allow an attacker who intercepts the token to reuse it for unauthorized access.

Recommendations Upgrade to version 3.2.0 or later to resolve this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Anish Giri

Saurabh Banawar

Vincent Beck

Vendors

Affected products

Weakness enumeration