CVE-2026-86473: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-86473 is an Insufficient Session Expiration vulnerability in Apache Airflow's Core API logout endpoint that fails to revoke bearer tokens presented via Authorization: Bearer headers, leaving them valid until natural expiration. It affects Apache Airflow versions 3.0.0 through 3.3.1 (fixed in 3.3.2). The vulnerability was disclosed on September 21, 2026, by OpenSec Intelligence (finder) and remediated by Jarek Potiuk (Apache Advisory, oss-security). It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is CWE-613 (Insufficient Session Expiration): the Core API logout handler in airflow/api_fastapi/core_api/routes/public/auth.py only read and revoked the _token cookie, ignoring any Authorization: Bearer token presented in the request header — the documented authentication method for API clients (GitHub PR). When a client authenticates via bearer token and calls the logout endpoint, the server returns a normal logout response but performs no revocation, leaving the token valid for its full lifetime (default 24 hours, configurable). The fix introduced a collect_request_tokens() function that walks the same credential precedence order as get_user() (bearer → OAuth token → trusted-middleware cached user → cookie) and revokes all presented credentials before any redirect or cookie deletion occurs (GitHub PR).

An attacker who has previously obtained a copy of a victim's valid bearer token retains full access to the victim's Apache Airflow account even after the victim explicitly logs out, for up to 24 hours (or longer if the token lifetime is extended). The attacker can perform any action within the victim's privilege scope — including reading DAG configurations, triggering pipeline runs, accessing connections and variables (which may contain credentials), and modifying workflow definitions — resulting in high confidentiality and integrity impact with no availability impact (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.40–0.75% (53rd percentile), indicating a low-to-moderate near-term exploitation probability (GitHub Advisory). Exploitation requires the attacker to already possess a valid bearer token, which is a significant precondition; however, once that token is obtained, exploitation is trivial and requires no further interaction.

1. Token Acquisition (Precondition): Obtain a valid Apache Airflow Core API bearer token through any means outside the scope of this CVE — e.g., network interception, credential theft, phishing, or access to a shared environment where tokens are exposed.
2. Confirm Token Validity: Use the token to make an authenticated API request (e.g., GET /api/v1/dags) with the header Authorization: Bearer <token> to confirm it is active.
3. Wait for Victim Logout: Monitor or wait for the legitimate token owner to log out of Airflow (e.g., via the UI or API). On unpatched versions (3.0.0–3.3.1), the logout endpoint only revokes the _token cookie and does not invalidate the bearer token.
4. Continue Unauthorized Access: After the victim believes their session has ended, continue using the bearer token to make authenticated API calls — reading sensitive DAG data, connections, variables, or triggering pipeline executions — for up to 24 hours or until the token's configured expiry (GitHub PR, oss-security).

• Network: API requests to Airflow Core API endpoints (e.g., /api/v1/dags, /api/v1/connections, /api/v1/variables) using Authorization: Bearer headers originating from unexpected IP addresses or user agents, particularly after the associated user account has logged out.
• Logs: Airflow access logs showing authenticated API activity for a user account after that user's session cookie was invalidated or after a logout event was recorded; repeated bearer-token-authenticated requests from a source IP different from the user's known location.
• Behavioral: API calls to sensitive endpoints (connections, variables, XCom data) occurring outside normal business hours or from unfamiliar clients after a logout event; unexpected DAG triggers or configuration changes attributed to a user who has logged out.

The primary remediation is to upgrade Apache Airflow to version 3.3.2 or later, which introduces collect_request_tokens() to revoke all credentials (bearer tokens and cookies) presented to the logout endpoint (Apache Advisory, GitHub PR). For organizations unable to upgrade immediately, interim mitigations include: reducing the API token lifetime from the default 24 hours to the shortest operationally acceptable value; implementing network-level monitoring to detect post-logout API activity; and auditing token issuance to minimize the number of long-lived tokens in circulation. There is no configuration-only workaround that fully prevents the issue on unpatched versions.

The Apache Security Team disclosed the vulnerability with a severity rating of "low" in the oss-security mailing list, noting the significant precondition that an attacker must already possess a valid token (oss-security). The NVD and GitHub Advisory Database rated it Critical (CVSS 9.1), reflecting the high confidentiality and integrity impact once the precondition is met. The NixOS security tracker flagged the issue for packaging updates shortly after disclosure (GitHub PR). No significant broader media coverage or notable researcher commentary beyond the official advisory channels has been identified.