PUBLISHED
2026-03-17 11:16
MODIFIED
2026-03-17 11:16
EPSS (Prob. Exploit)
0.78%
Top 44.3%
> DESCRIPTION
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-668: Exposure of Resource to Wrong Sphere - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
> GITHUB SECURITY ADVISORY
GHSA-4fhm-p86v-hwpx
HIGH
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
AFFECTED PACKAGES:
PIP / apache-airflow
>= 3.0.0, < 3.1.8
Fixed in: 3.1.8
> HISTORIQUE DES MODIFICATIONS
Première apparition
17/03/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/04/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-668: Exposure of Resource to Wrong Sphere - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Total des modifications: 1
Dernière mise à jour: 7 months ago