PT-2026-25887 · Apache · Apache Airflow

Daniel Wolf · Publicado 2026-03-17 · Atualizado 2026-03-18 · CVE-2026-28779

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.7

Description The session token ( token) in cookies for Apache Airflow is set to path=/ regardless of the configured base url for the webserver or api. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, potentially leading to a full session takeover without directly attacking Airflow. The base url configuration determines the path prefix for Airflow web application URLs. When the session token path is not correctly aligned with the base url, it becomes vulnerable to cross-site scripting (XSS) and session hijacking attacks.

Recommendations Upgrade to Apache Airflow version 3.1.8 or later to resolve this issue.

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

BDU:2026-05613

BIT-AIRFLOW-2026-28779

CVE-2026-28779

GHSA-4FHM-P86V-HWPX

PYSEC-2026-16

Produtos afetados

Apache Airflow

Referências · 18

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/62771 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-16.yaml · Nota
• https://twitter.com/cyberbivash/status/2033938755950702930 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2033868794414731669 · Publicação no Twitter
• https://github.com/advisories/GHSA-4fhm-p86v-hwpx · Nota
• http://openwall.com/lists/oss-security/2026/03/17/3 · Nota
• https://twitter.com/oss_security/status/2033945930496442553 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033994284115091686 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-airflow-2026-28779 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2033955319232270342 · Publicação no Twitter
• https://osv.dev/vulnerability/PYSEC-2026-16 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4fhm-p86v-hwpx · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2033893887379456021 · Publicação no Twitter
• https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb · Aviso do Fabricante