PT-2026-45366 · Apache · Apache Airflow

Jarek Potiuk · CVE-2026-41017 · Published 2026-06-01 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description The JWTRefreshMiddleware sets the JWT authentication cookie without the Secure flag. In deployments where the Airflow API server is positioned behind an HTTPS-terminating reverse proxy, the session JWT can be replayed over cleartext HTTP requests to the same host. A network-positioned attacker could induce a logged-in user's browser to issue an HTTP request to the hostname, capture the JWT cookie, and replay it against the authenticated API.

Recommendations Upgrade to version 3.2.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-614

Related Identifiers

BIT-AIRFLOW-2026-41017

CVE-2026-41017

ECHO-D4B8-3EB5-0C63

GHSA-95V7-H9J5-GVJR

PYSEC-2026-171

Affected Products

Apache Airflow

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41017.json · Exploit
• https://github.com/apache/airflow/pull/65348 · Patch
• https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41017 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-95v7-h9j5-gvjr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41017 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2026-41017 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-171.yaml · Note
• https://github.com/advisories/GHSA-95v7-h9j5-gvjr · Note
• https://t.me/cveNotify/165436 · Telegram Post
• https://pypi.python.org · Note
• http://openwall.com/lists/oss-security/2026/05/31/6 · Note
• https://t.me/CVEtracker/55447 · Telegram Post