Zetlyn
GitHubGet started

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it…

cve CVE-2025-57735 1 source, 1 claim · Watch

NVD writes:
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue. the claim
Severity
CRITICAL NVD
CVSS
9.1 NVD
Fixed in
3.2.0 NVD
Vendor
Apache Software Foundation NVD
Product
Apache Airflow NVD
CWE
CWE-613 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2026-04-09first spoke of it: When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.NVD

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.

What it is to other things

affectsapache/airflow
NVD
made_byapache
NVD

In words only, so not counted until a person confirms one:

made_byapache_software_foundation
NVD says “Apache Software Foundation”
affectsapache_software_foundation/apache_airflow
NVD says “Apache Software Foundation · Apache Airflow”
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDyes
An attacker can reliably run all of the kill chain's first four steps without a person.
receipt
Source
NVD
Its words
yes
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCyes
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
NVD9.1
receipt
Source
NVD
Its words
9.1
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
receipt
Source
NVD
Its words
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
NVDCWE-613
receipt
Source
NVD
Its words
CWE-613
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCWE-613
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCnone
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Fixed in
fixed_in
NVD3.2.0
receipt
Source
NVD
Its words
3.2.0
Read by
field:cve.affected[].affectedData[].versions[status=affected].lessThan
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTC3.2.0
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDApache Airflow
receipt
Source
NVD
Its words
Apache Airflow
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
NVDCRITICAL
From the CVSS base score at 9.0 and above.
receipt
Source
NVD
Its words
CRITICAL
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCRITICAL
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
critical
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCpartial
2026-10-02 12:00 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDApache Software Foundation
receipt
Source
NVD
Its words
Apache Software Foundation
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-02 12:00 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://pypi.python.org",
            "defaultStatus": "unaffected",
            "packageName": "apache-airflow",
            "product": "Apache Airflow",
            "vendor": "Apache Software Foundation",
            "versions": [
              {
                "lessThan": "3.2.0",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@apache.org"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D8133DE3-F556-42F5-8298-FD4CF40787B6",
                "versionEndExcluding": "3.2.0",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+\n\n\n\nUsers are recommended to upgrade to version 3.2.0, which fixes this issue."
      },
      {
        "lang": "es",
        "value": "Cuando el usuario cerró sesión, el token JWT con el que se había autenticado no fue invalidado, lo que podría llevar a la reutilización de ese token en caso de que fuera interceptado. En Airflow 3.2 implementamos el mecanismo que implementa la invalidación de tokens al cerrar sesión. Los usuarios que estén preocupados por el escenario de cierre de sesión y la posibilidad de interceptar los tokens, deberían actualizar a Airflow 3.2+.\n\nSe recomienda a los usuarios actualizar a la versión 3.2.0, que corrige este problema."
      }
    ],
    "id": "CVE-2025-57735",
    "lastModified": "2026-09-30T22:10:00.273",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-57735",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-04-09T13:53:16.618977Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-04-09T11:16:20.757",
    "references": [
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/56633"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Issue Tracking"
        ],
        "url": "https://github.com/apache/airflow/pull/61339"
      },
      {
        "source": "security@apache.org",
        "tags": [
          "Mailing List",
          "Vendor Advisory"
        ],
        "url": "https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98"
      },
      {
        "source": "af854a3a-2127-422b-91ae-364da2661108",
        "tags": [
          "Mailing List",
          "Third Party Advisory"
        ],
        "url": "http://www.openwall.com/lists/oss-security/2026/04/09/16"
      }
    ],
    "sourceIdentifier": "security@apache.org",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "security@apache.org",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.
zetlyn/cve-nvd · 2026-04-09
automatable yes cvss 9.1 cvss_vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N cwe CWE-613 exploitation none fixed_in 3.2.0 product Apache Airflow severity CRITICAL status Analyzed technical_impact partial vendor Apache Software Foundation source