CVE-2026-86473

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2

Description The Core API logout endpoint only revokes session tokens provided via the token cookie. If a client uses an Authorization bearer header for authentication during logout, the endpoint returns a successful response without revoking the token. This allows the token to remain valid until its expiration, which is 24 hours by default. An attacker possessing a copy of this token can maintain access to the victim's account even after the victim has logged out.

Recommendations Upgrade to version 3.3.2 or later.