# CVE-2026-113508: Apache Airflow: Logout token revocation fails open; errors silently swallowed

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: apache) — https://github.com/apache/airflow/pull/73562
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: apache) — https://github.com/apache/airflow/pull/73788

## Affected products and versions

- Apache Software Foundation / Apache Airflow (apache-airflow-core): ≥ 0; < 3.4.0 (affected, semver). Source: CNA: apache

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-613

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/apache/airflow/pull/73562 (CNA: apache; patch)

- https://github.com/apache/airflow/pull/73788 (CNA: apache; patch)

- https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no (CNA: apache; vendor-advisory)

- http://www.openwall.com/lists/oss-security/2026/11/09/20 (ADP: CVE)

## Provenance

- CNA: apache: https://www.cve.org/CVERecord?id=CVE-2026-113508; retrieved 2026-11-09; source updated 2026-11-09

Revision: e9f56133cd73655c51cb7324f89c6dd54f311eecde9d461ed82faf81669a13a7

Canonical: https://y2.dev/cve/CVE-2026-113508

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.