Apache Airflow: resource exposure

CVE-2026-28779 · Published Mar 17, 2026 · updated Jun 5, 2026

High7.5

Fix: upgrade to 3.1.8 or later

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.

This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

Affected versions

Package	Affected	Fixed in
apache-airflow PyPI	>= 3.0.0, < 3.1.8	3.1.8

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-668
Also known as: BIT-airflow-2026-28779, CVE-2026-28779, PYSEC-2026-16

More Apache Airflow advisories

All Apache Airflow

Medium 4.8Mar 31

Apache Airflow: improper certificate validationCVE-2026-32794fixed in 1.12.0 High 8.1Mar 17

Apache Airflow: Execution API HITL Endpoints Missing Per-Task AuthorizationCVE-2026-30911fixed in 3.1.8 Medium 4.3Mar 17

Apache Airflow: DAG authorization bypassCVE-2026-28563fixed in 3.1.8 High 7.5Mar 17

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataCVE-2026-26929fixed in 3.1.8 Medium 6.5Feb 24

Apache Airflow exposes sensitive information in its log filesCVE-2025-27555fixed in 2.11.1 High 8.4Feb 24

Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate tableCVE-2024-56373fixed in 2.11.1