{"action":"Upgrade apache-airflow to 3.3.2 or later.","affected":[{"fixed":"3.3.2","introduced":"3.0.0"}],"component":"apache-airflow","cve_ids":["CVE-2026-86473"],"ecosystem":"PyPI","epss":0.00747,"exploited":false,"fixed_versions":["3.3.2"],"id":"tcs_01M5KH944KRABMGHRB0BST55VB","modified_at":"2026-09-26T09:25:45.483745929Z","published_at":"2026-09-21T15:17:32.997Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3990","http://www.openwall.com/lists/oss-security/2026/09/21/5","https://lists.apache.org/thread/k9z1p0q1ng8m68nlnv9d1fqzscrfm7vr","https://github.com/apache/airflow/pull/72649"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-3990","url":"https://osv.dev/vulnerability/PYSEC-2026-3990"}],"summary":"Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, th"}