Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications (Apache Software Foundation Apache Airflow)

CVE-2026-28779

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 0.70 % · centile 53 (2026-10-29)
État: PUBLISHED
Publiée: 2026-03-17 10:15 UTC
Mise à jour: 2026-03-17 13:45 UTC
Attribuée par: apache
Statut NVD: Analyzed

Description

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Faiblesses (CWE)

CWE-668 — Exposition d'une ressource à la mauvaise sphère

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Avis

GHSA-4fhm-p86v-hwpx — Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
PYSEC-2026-16 — Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_u

Références européennes

ENISA EUVD · EUVD-2026-12558
GCVE · GCVE-0-2026-28779

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.1.8

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Airflow	affected 3.0.0 < 3.1.8

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications (Apache Software Foundation Apache Airflow)