When a request to the Airflow core API carries both a session cookie and an...
Medium4.2CVE-2026-82355 · Published Sep 21, 2026 · updated Sep 26, 2026
When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the identity the client explicitly presented. Only Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier releases do not contain the code path that caches the cookie-derived user, and are not vulnerable. Exploiting this requires an attacker to first place a valid session cookie of their own into the victim's browser or client: for example by cookie tossing from a sibling subdomain, through cross-site scripting in a separate application sharing a parent domain, or via a shared workstation. Deployments that host the Airflow UI on a domain shared with other applications are therefore the most exposed; a deployment on a dedicated domain with no co-hosted applications is not reachable this way. The consequence is principal confusion and misattributed audit records rather than a direct privilege escalation. Users of 3.3.0 or 3.3.1 should upgr...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | <= 3.3.0 | No fix yet |
| <= 3.3.1 | No fix yet |
Details and references
When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the identity the client explicitly presented. Only Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier releases do not contain the code path that caches the cookie-derived user, and are not vulnerable. Exploiting this requires an attacker to first place a valid session cookie of their own into the victim's browser or client: for example by cookie tossing from a sibling subdomain, through cross-site scripting in a separate application sharing a parent domain, or via a shared workstation. Deployments that host the Airflow UI on a domain shared with other applications are therefore the most exposed; a deployment on a dedicated domain with no co-hosted applications is not reachable this way. The consequence is principal confusion and misattributed audit records rather than a direct privilege escalation. Users of 3.3.0 or 3.3.1 should upgrade to Apache Airflow 3.3.2 or later, which resolves the caller from the explicitly supplied credential whenever one is present.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Severity from
- the CVSS score
- Also known as
- BIT-airflow-2026-82355, CVE-2026-82355
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 21 | Apache Airflow: the Core API logout endpoint revokes only a session token... Critical9.1Sep 21 | Critical9.1 | 3.3.2 |
| Sep 21 | Apache Airflow: improper access controlMedium4.3Sep 21 | Medium4.3 | 3.3.2 |
| Aug 12 | Apache Airflow's Backfill API authorized a request against a Dag id supplied by...High7.5Aug 12 | High7.5 | 3.3.1 |
| Aug 12 | Apache Airflow wrote Variable values and Connection `extra` contents to the...Medium6.5Aug 12 | Medium6.5 | 3.3.1 |
| Aug 12 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON...Medium6.5Aug 12 | Medium6.5 | 3.3.1 |
| Aug 12 | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by...High8.8Aug 12 | High8.8 | 3.3.1 |