CVE-2026-86473

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable. Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained. Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.

• CWE-613

• https://github.com/apache/airflow/pull/72649Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread/k9z1p0q1ng8m68nlnv9d1fqzscrfm7vrMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/21/5Mailing List, Third Party Advisory

Published

Sep 21, 2026

Last Modified

Nov 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86467Apache Airflow Amazon provider: the AWS auth manager's SAML …8.8
• CVE-2026-86468Apache Airflow's CLI records its arguments in the audit log …6.5
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8
• CVE-2026-86471An unvalidated runtime configuration value in Apache CouchDB…9.3
• CVE-2026-86472fast-uri is a dependency-free RFC 3986 URI parser for Node.j…4.8
• CVE-2026-86474The lack of TLS certificate validation when downloading firm…7.7
• CVE-2026-86475The Appointment Hour Booking WordPress plugin before 1.5.95 …5.3
• CVE-2026-86476A flaw was found in gst-plugins-base. A heap buffer overflow…8.4
• CVE-2026-86477Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-86478In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 im…9.8
• CVE-2026-86479In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2…8.1