Apache Airflow’s logout endpoint only revokes the session token stored in the _token cookie, but ignores a bearer token supplied in the Authorization header. If a victim logs out while still presenting a bearer token, the system returns the standard logout confirmation yet leaves that bearer token valid until its expiry. An attacker who previously obtained a copy of the victim’s bearer token can therefore continue to act as the victim for up to the token’s lifetime, typically 24 hours unless reconfigured. No new privileges are granted; the attacker can only use the victim’s existing permissions.

The issue affects installations of Apache Airflow prior to version 3.3.2. All API clients that authenticate via Authorization bearer tokens are susceptible, while browser‑based sessions using the _token cookie are correctly invalidated on logout.

The vulnerability does not allow privileges beyond the victim’s own; therefore it does not lead to privilege escalation or remote code execution. Exploitation requires the attacker to already possess a valid bearer token, which is outside the scope of this flaw. No EPSS score is publicly available and the vulnerability is not listed in CISA KEV. The risk is high, as indicated by the CVSS score of 9.1; typical attackers who have stolen or captured a bearer token can maintain unauthorized access for the remainder of the token’s life. The attack vector is essentially a token‑reuse scenario where the logout endpoint’s ignoring of bearer tokens lets an attacker keep using a legitimate credential.