CVE-2025-57735

CRITICAL9.1EPSS 0.03%

Apache Airflow: Airflow Logout Not Invalidating JWT

發布日:2026/4/9修改日:2026/4/13

也稱為:GHSA-c92r-g8j5-vhcxBIT-airflow-2025-57735

描述

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.

受影響套件(2)

Bitnami/airflow>= 3.0.0, < 3.2.0
PyPI/apache-airflow>= 3.0.0, < 3.2.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-57735
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/pull/56633
WEBhttps://github.com/apache/airflow/pull/61339
WEBhttps://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98
WEBhttp://www.openwall.com/lists/oss-security/2026/04/09/16