What is the CVSS score of CVE-2025-57735?

CVE-2025-57735 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Airflow are affected by CVE-2025-57735?

Apache Airflow versions 3.0.0 through 3.1.x contain a critical session management flaw where JWT tokens remain valid after user logout, enabling attackers with intercepted credentials to maintain…. A patch is available.

How to fix or mitigate CVE-2025-57735?

Within 24 hours: Inventory all Apache Airflow deployments and identify instances running versions 3.0.0-3.1.x; assess token exposure risk in logs and monitoring systems. Within 7 days: Deploy Apache Airflow 3.2.0 or later across all affected instances; implement token rotation policies requiring immediate invalidation at logout. Within 30 days: Conduct audit of API access logs for version 3.0.0-3.1.x deployments from the past 90 days to identify potential unauthorized token replay; rotate any JWT secrets and issue new authentication credentials.

Airflow CVE-2025-57735

EUVD-2025-209371 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-04-09 security@apache.org

GHSA-c92r-g8j5-vhcx

Information Disclosure Airflow

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 13:12 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 13:07 vuln.today

cvss_changed

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 11:22 euvd

EUVD-2025-209371

Analysis Generated

Apr 09, 2026 - 11:22 vuln.today

CVE Published

Apr 09, 2026 - 11:16 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on apache-airflow (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

AnalysisAI

Apache Airflow 3.0.0 through 3.1.x fails to invalidate JWT tokens at logout, allowing intercepted tokens to remain valid for unauthorized API access. This session management weakness enables replay attacks against the workflow orchestration platform's REST API. No active exploitation confirmed (EPSS 3rd percentile), but SSVC rates as automatable with partial technical impact. Vendor-released patch: Apache Airflow 3.2.0.

Technical ContextAI

Apache Airflow is a workflow orchestration platform that uses JWT (JSON Web Token) authentication for its REST API. The vulnerability stems from improper session termination (CWE-613: Insufficient Session Expiration). When users authenticated to Airflow's web interface and logged out, the application failed to add the JWT to a revocation list or otherwise mark it as invalid. JWTs are cryptographically signed tokens that typically include an expiration timestamp but no server-side state. Without explicit invalidation mechanisms like token blacklisting or database-backed session tracking, a valid JWT remains usable until its built-in expiration time passes. The affected CPE (cpe:2.3:a:apache:airflow) covers versions 3.0.0 through 3.1.x. Airflow 3.2.0 introduced a token invalidation mechanism, likely implemented via the referenced GitHub pull requests 56633 and 61339, which may use Redis-backed token blacklisting, database session tables, or JTI (JWT ID) tracking to prevent reuse of logged-out tokens.

RemediationAI

Upgrade to Apache Airflow 3.2.0 or later, which implements JWT token invalidation at logout via changes in GitHub pull requests 56633 and 61339. Before patching, implement compensating controls: reduce JWT token expiration times to minimize the replay window (edit airflow.cfg webserver.access_token_expiration to 600 seconds or less, noting this requires users to re-authenticate more frequently), enforce HTTPS for all Airflow web interfaces to prevent passive token interception (configure webserver.web_server_ssl_cert and web_server_ssl_key), restrict network access to Airflow's webserver port (default 8080) to trusted IP ranges via firewall rules (reduces token exposure surface but does not prevent replay attacks from allowed networks), and implement short-lived refresh tokens if customizing authentication (requires code changes and operational complexity). Monitor for anomalous API access patterns such as simultaneous sessions from different IP addresses or access after logout events in webserver logs. Note that reducing token expiration creates operational friction for legitimate users who must authenticate more frequently. No workaround fully mitigates the issue; upgrade to 3.2.0 is the only complete fix. Advisory: https://lists.apache.org/thread/ovn8mpd8zkc604hojt7x3wsw3kc60x98.