CVE-2025-57735: 
Apache Airflow vulnerability analysis and mitigation

CVE-2025-57735 is an insufficient session expiration vulnerability in Apache Airflow where JWT tokens remain valid after a user logs out, enabling token reuse if intercepted. It affects Apache Airflow versions 3.0.0 through 3.1.x (all versions before 3.2.0). The vulnerability was published on April 9, 2026, and is classified as Critical with a CVSS v3.1 base score of 9.1 (Github Advisory, Feedly).

The root cause is CWE-613 (Insufficient Session Expiration): upon logout, Airflow did not invalidate the JWT token's JTI (JWT ID), meaning the token remained cryptographically valid until its natural expiration. An attacker who intercepts a JWT token — for example, via network sniffing or credential theft — can continue to use it to authenticate to the Airflow API even after the legitimate user has logged out. No privileges are required and no user interaction is needed, as the attack is purely network-based. The fix, implemented in Airflow 3.2.0 via PR #61339, introduces a revoked_token database table that stores revoked JTIs on logout; every authenticated request now checks this table before granting access, and expired revoked tokens are automatically cleaned up (Github Advisory, Airflow PR #61339).

A successful exploit allows an unauthenticated attacker who has intercepted a valid JWT token to authenticate to Airflow and perform any action permitted by the original user's privileges, including reading sensitive DAG configurations, triggering pipeline runs, accessing credentials stored in connections and variables, and potentially pivoting to downstream systems. The vulnerability carries high confidentiality and high integrity impact with no availability impact, meaning sensitive workflow data and system configurations can be exposed or manipulated without detection. Organizations running Airflow in network-accessible environments — particularly those orchestrating data pipelines with access to databases, cloud services, or internal APIs — face the greatest risk of lateral movement and data exfiltration (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of this report (Feedly). The EPSS score is approximately 0.015% (0.03% per GitHub Advisory), placing it in a low exploitation probability tier in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no privileges and no user interaction, lowering the barrier for exploitation once a token is obtained through interception or other means.

1. Token Interception: Position to intercept network traffic between an Airflow user and the Airflow API server — for example, via a man-in-the-middle attack on an unencrypted or improperly configured HTTPS connection, or by accessing logs/proxies that capture Authorization headers.
2. Capture JWT Token: Extract the Bearer JWT token from an HTTP request header (e.g., Authorization: Bearer <token>) made by a legitimate Airflow user during an active session.
3. Wait for User Logout: Allow or observe the legitimate user to log out of Airflow. On vulnerable versions (3.0.0–3.1.x), the token is not invalidated server-side.
4. Replay the Token: Use the captured JWT token to make authenticated API requests to the Airflow REST API (e.g., GET /api/v1/dags, POST /api/v1/dags/{dag_id}/dagRuns) with the header Authorization: Bearer <captured_token>.
5. Achieve Unauthorized Access: Continue accessing Airflow resources — reading connections, variables, DAG code, or triggering pipeline runs — with the original user's privileges until the token's natural expiration time is reached (Github Advisory, Airflow PR #61339).

• Network: API requests to Airflow endpoints (e.g., /api/v1/dags, /api/v1/connections, /api/v1/variables) using a JWT token that was previously associated with a logged-out session; requests originating from IP addresses different from the original authenticated session.
• Logs: Airflow API access logs showing authenticated requests with a JWT token after the corresponding user's logout event; repeated API calls from unexpected source IPs using the same token JTI.
• Authentication Events: Successful API authentication events occurring after a user logout timestamp in Airflow audit logs, particularly if the source IP or user-agent differs from the original session.
• Behavioral: Unexpected DAG triggers, connection reads, or variable accesses in Airflow audit logs that do not correspond to any active user session.

The primary remediation is to upgrade Apache Airflow to version 3.2.0 or later, which implements JWT token invalidation at logout via a revoked_token table (Github Advisory, Airflow PR #61339). There is no configuration-based workaround available for versions 3.0.0–3.1.x; the fix requires the code changes introduced in 3.2.0. As interim risk reduction measures, enforce HTTPS for all Airflow API traffic to prevent token interception, implement short JWT token expiration windows where configurable, and monitor API access logs for anomalous authentication patterns following user logout events.

The vulnerability was covered by The Hacker Wire and appeared in a Reddit CVE trending list, indicating moderate community awareness (Feedly). A USA Today contributor piece highlighted the engineer who contributed the fix, noting Airflow's use by Fortune-class enterprises. The Apache Airflow maintainer community nominated the fixing PR (#61339) for "PR of the Month," with contributors noting it "opens the door for great security improvements such as a token invalidation endpoint for administrators in case of a token leak" (Airflow PR #61339). Qualys added detection for this vulnerability in April 2026 (detection IDs 5010829 and 531130).