PT-2026-25887 · Apache · Apache Airflow

Daniel Wolf · Published 2026-03-17 · Updated 2026-03-18 · CVE-2026-28779

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.7

Description The session token ( token) in cookies for Apache Airflow is set to path=/ regardless of the configured base url for the webserver or api. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, potentially leading to a full session takeover without directly attacking Airflow. The base url configuration determines the path prefix for Airflow web application URLs. When the session token path is not correctly aligned with the base url, it becomes vulnerable to cross-site scripting (XSS) and session hijacking attacks.

Recommendations Upgrade to Apache Airflow version 3.1.8 or later to resolve this issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2026-05613

BIT-AIRFLOW-2026-28779

CVE-2026-28779

GHSA-4FHM-P86V-HWPX

PYSEC-2026-16

Affected Products

Apache Airflow

References · 17

• https://github.com/apache/airflow/pull/62771 · Patch
• https://bdu.fstec.ru/vul/2026-05613 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28779 · Vendor Advisory
• https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28779 · Security Note
• https://osv.dev/vulnerability/GHSA-4fhm-p86v-hwpx · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-28779 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-16.yaml · Note
• https://twitter.com/CVEarity/status/2033955319232270342 · Twitter Post
• http://openwall.com/lists/oss-security/2026/03/17/3 · Note
• https://twitter.com/oss_security/status/2033945930496442553 · Twitter Post
• https://twitter.com/CVEnew/status/2033994284115091686 · Twitter Post
• https://twitter.com/cyberbivash/status/2033893887379456021 · Twitter Post