[<prev] [next>] [day] [month] [year] [list]
Message-ID: <f36ea09f-f005-1c69-fdbd-b80c13b2a0b9@apache.org>
Date: Tue, 17 Mar 2026 06:24:00 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-28779: Apache Airflow: Path of session token in cookie
does not consider base_url - session hijacking via co-hosted applications
Severity: Medium
Affected versions:
- Apache Airflow (apache-airflow) 3.0.0 before 3.1.8
Description:
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Credit:
Daniel Wolf (finder)
Daniel Wolf (remediation developer)
References:
https://github.com/apache/airflow/pull/62771
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-28779
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
