Executive brief
Apache Airflow is a platform used to programmatically author, schedule, and monitor workflows. A security flaw in how the application handles login cookies allows other applications hosted on the same web domain to intercept user session tokens. An attacker who controls a neighboring application on the same domain could use these stolen tokens to take over Airflow user accounts, potentially gaining unauthorized access to sensitive workflow data and operational controls.
Technical details
Apache Airflow versions 3.0.0 through 3.1.7 fail to correctly scope the session cookie (_token) to the configured base_url for the webserver or API. Instead, the cookie path is set to the domain root (path=/) by default. If other applications are co-hosted on the same domain (e.g., under different subpaths), they can receive the Airflow session token in HTTP request headers. An attacker with control over a co-hosted application can capture these tokens to perform a full session takeover. This is classified as CWE-668 (Exposure of Resource to Wrong Sphere). The issue is resolved in version 3.1.8 by properly scoping the cookie path to the configured base_url.
Affected products
- Apache Airflow >= 3.0.0, < 3.1.8
Timeline
- 2026-03-03: other: Pull request to fix the issue submitted
- 2026-03-17: advisory: GHSA and NVD advisories published
- 2026-03-17: disclosed: Public disclosure on oss-security mailing list