A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB / Keycloak logout paths.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the
    user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` did not
    actually reach the underlying `revoke_token()` call, so the JWT remained accepted by the API server until
    its natural expiry. An attacker holding a previously-issued JWT for a logged-out user could continue to
    make authenticated API calls as that user. Affects deployments configured with `FabAuthManager` or
    `KeycloakAuthManager` (the bug does not affect SimpleAuthManager). This is a residual gap in the fix for
    CVE-2025-57735, which addressed cookie-side invalidation in PR #57992 / PR #61339 but did not cover the
    provider-side `revoke_token()` reachability in the FAB / Keycloak code paths. Users who already upgraded
    for CVE-2025-57735 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the FAB /
    Keycloak logout paths. (CVE-2026-48726)

ID	Name	Product	Family	Type	Severity
461608	Echo: apache-airflow: security update to 3.2.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461608	Echo: apache-airflow: security update to 3.2.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
444545	SCA: security update for apache-airflow (GHSA-vr7m-c6v4-8cx8)	Tenable Cloud Security	SCA Checks	Local	medium
444545	SCA: security update for apache-airflow (GHSA-vr7m-c6v4-8cx8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-48726

medium

Tenable Plugins

medium

medium

medium

medium