VDB
EN
CRITICAL 9.1

PYSEC-2026-269

Apache Airflow: JWT token still valid after logout

상세

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / apache-airflow
최초 영향 버전: 3.0.0 수정 버전: 3.2.0
수정 pip install --upgrade 'apache-airflow>=3.2.0'

참고