What is the CVSS score of CVE-2026-48726?

CVE-2026-48726 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48726?

Yes, a patch is available for CVE-2026-48726. Update the affected software to the latest version immediately.

Apache Airflow CVE-2026-48726

EUVD-2026-33581 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-05-31

GHSA-vr7m-c6v4-8cx8

Authentication Bypass Apache Python

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 17:27 vuln.today

Analysis Generated

Jun 02, 2026 - 17:27 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

6.5 (MEDIUM)

Patch available

Jun 01, 2026 - 10:01 EUVD

CVE Published

May 31, 2026 - 12:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 31, 2026 - 12:45 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 pypi packages depend on apache-airflow (4 direct, 4 indirect)

Ecosystem-wide dependent count for version 3.2.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

JWT session tokens remain valid after logout in Apache Airflow deployments using FabAuthManager or KeycloakAuthManager due to an unreachable revoke_token() call in the logout code path. Versions before 3.2.2 are affected. When the configured auth manager returns an external redirect URL on logout (as Keycloak-backed deployments do), the logout handler redirects the browser before invoking revoke_token(), leaving the JWT - with its embedded jti claim - unregistered in the RevokedToken table and therefore still accepted by the API. No public exploit is identified at time of analysis, and EPSS exploitation probability stands at 0.01% (4th percentile), but the impact is meaningful in environments where session hijacking or token theft is a realistic threat model.

Technical ContextAI

Apache Airflow's FastAPI-based REST API (airflow-core/src/airflow/api_fastapi/core_api/routes/public/auth.py) issues JWT access tokens stored as cookies, identified by a jti (JWT ID) claim. The RevokedToken mechanism is designed to blocklist tokens server-side upon logout, compensating for JWTs' inherent statelessness. CWE-613 (Insufficient Session Expiration) is the root cause class: the token's expiry was never actively enforced on logout when an external identity provider is involved. The defect arises specifically when get_url_logout() on FabAuthManager or KeycloakAuthManager returns a non-None redirect URL - the logout route performed a 307 redirect before reaching the revoke_token() call, rendering revocation dead code in those auth manager configurations. Affected versions span Apache Airflow 0 through 3.2.2 (exclusive) per EUVD-2026-33581 CPE data.

RemediationAI

Upgrade Apache Airflow to version 3.2.2 or later, which contains the fix confirmed in upstream PR #67289. The patch reorders the logout handler to call auth_manager.revoke_token(token_str) before any redirect is issued, ensuring the token's jti is registered in the RevokedToken blocklist regardless of whether the auth manager redirects to an external IdP URL. The Apache advisory is at https://lists.apache.org/thread/630jg4z6cjkv4m2yv2ljgmf1zhdj1vqx. If immediate upgrade is not feasible and you are using an external auth manager with a logout redirect URL, a compensating control is to shorten JWT token TTL to the minimum operationally tolerable value in Airflow's configuration (api.access_token_lifetime_in_seconds), reducing the window during which a post-logout token remains valid. Note this trade-off: shorter TTLs increase re-authentication friction for users. Revoking session cookies server-side or deploying a reverse proxy that clears the JWT cookie on logout does not address the server-side RevokedToken gap and is not a sufficient standalone mitigation.