A critical session management vulnerability in Apache Airflow allows unauthorized access to persist via unrevoked bearer tokens after logout, posing a significant risk of session hijacking.

This vulnerability involves insufficient session expiration (CWE-613) where the logout endpoint fails to revoke authentication credentials provided via Authorization bearer headers. While the endpoint processes the request, it only clears the browser session cookie, leaving the bearer token functional until its natural expiration.

The flaw allows an attacker who has intercepted a valid bearer token to maintain unauthorized access to the Airflow instance even after the legitimate user has performed a logout action. Given the CVSS score of 9.1, this vulnerability poses a high risk of unauthorized data access and potential manipulation of workflow configurations, which could lead to severe operational disruption or sensitive information disclosure.

Immediate Action: Upgrade Apache Airflow to version 3.3.2 or later to ensure the logout endpoint correctly invalidates all token types.

Proactive Monitoring: Monitor API access logs for anomalous activity, particularly for sessions that persist beyond expected user logout times or originate from unusual geographic locations.

Compensating Controls: Reduce the default token lifetime within the Airflow configuration to limit the window of opportunity for an attacker holding a stale token.

Public Exploit Available: No — exploit_available: unknown.

This vulnerability represents a critical security oversight in session handling that allows attackers to maintain persistence. Organizations utilizing Apache Airflow with API-based authentication must prioritize the upgrade to version 3.3.2 immediately. Until the patch is applied, administrators should review token lifetime configurations to minimize the impact of potential session hijacking.