CVE-2026-28779

CWE-668 — Exposure to Wrong Sphere5 documents5 sources
Severity
7.5HIGH
EPSS
0.1%
top 74.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedMar 17

Description

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/airflow3.0.0 — 3.1.8
▶PyPIapache-airflow3.0.0 — 3.1.8

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications↗2026-03-17
▶
CVEList
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications↗2026-03-17
▶
GHSA
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications↗2026-03-17
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-28779 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-28779 (HIGH CVSS 7.5) | Apache Airflow versions 3.1.0 throu | cvebase.io