CVE-2026-86473: Apache Airflow Logout Flaw Leaves Tokens Valid

Executive Summary

Apache Airflow's Core API logout endpoint fails to revoke session tokens presented via the Authorization: Bearer header, according to a patch merged into the project's main branch and tracked as CVE-2026-86473 with a CVSS score of 9.1. The endpoint revokes only a session token supplied as the _token cookie. When a client logs out by presenting its credential as a bearer token instead, the API returns its normal logout response but revokes nothing, leaving the token valid until it expires naturally.

The practical consequence is that any party holding a copy of that token — a leaked log, a compromised workstation, a misconfigured proxy, a stolen browser session — retains the victim's access to the Airflow Core API after the legitimate user believes they have logged out. The vulnerability is rated critical on the basis of the published CVSS 9.1 base score. No public exploitation has been reported in the source material, and no threat actor has been attributed.

Technical Analysis

The flaw sits in the logout handler of the Airflow Core API. According to the patch description, the endpoint's revocation logic is scoped to a single credential channel: the _token cookie. Airflow's Core API accepts authentication via either that cookie or a standard Authorization: Bearer <token> header, and the two paths converge on the same session object. The logout handler, however, only looks for the cookie form.

When a client sends a logout request with the token in the bearer header, the handler does not find a _token cookie to revoke. It still returns the API's normal logout response — meaning the caller has no signal that revocation did not occur. The bearer token remains a valid credential against the Core API until its own expiry window elapses.

This is an authentication-state desynchronization issue rather than a memory-safety or injection flaw. There is no remote code execution primitive described in the source material, and no pre-authentication bypass: an attacker must already hold a copy of a valid token. The severity derives from the fact that logout is a security control defenders rely on to terminate access after credential exposure, and in the bearer-header case that control silently does nothing.

Airflow is widely deployed as an orchestration layer for data pipelines, and its Core API tokens frequently carry broad privileges over DAG execution, connection definitions, and variable storage — which is why a token that survives logout is materially worse than a token that simply expires on schedule.

The source material does not specify which Airflow release lines are affected, nor does it state whether a patched release has shipped. The reference points to a pull request in the Apache Airflow repository, which indicates the fix has been merged into the development branch; downstream availability in a tagged release is not confirmed by the sources reviewed here.

Mitigations & Recommendations

Because the source material does not yet confirm a released patched version, defenders should treat token rotation as the primary compensating control. Any Airflow Core API token that may have been transmitted via an Authorization: Bearer header and subsequently "logged out" should be considered live and rotated immediately, regardless of whether the user session was closed.

Operationally, teams should audit their Airflow API clients to determine which integrations authenticate via bearer headers rather than the _token cookie, since those are the clients whose logout calls are ineffective. Where possible, shorten token lifetimes so that the exposure window after a failed revocation is bounded by configuration rather than by the token's original expiry.

Monitoring should focus on Core API activity originating from tokens that a user or service believes to be retired. Because the logout response is indistinguishable from a successful revocation, log-based detection is the only reliable way to catch post-logout token reuse. Administrators should also restrict network reachability to the Core API so that a leaked token is not usable from arbitrary source addresses.