Executive brief
Apache Airflow, a platform used to schedule and monitor complex workflows, contains a security flaw in its login system. An attacker can create a malicious link that appears to belong to a trusted Airflow site but actually redirects users to a fraudulent website. This could be used in phishing attacks to steal user credentials or deliver malware by tricking employees into thinking they are still on their company's secure platform.
Technical details
An open redirect vulnerability (CWE-601) exists in Apache Airflow's login redirect route. The 'is_safe_url' validation function failed to properly handle specific URL patterns, such as those starting with triple slashes (///), which certain JavaScript URL parsers interpret as valid absolute URLs. An attacker can exploit this by crafting a 'next=' query parameter that bypasses internal safety checks, allowing a redirection from the trusted Airflow domain to an arbitrary external origin. While the advisory mentions authenticated users, the CVSS vector (PR:N) suggests it may be exploitable via unauthenticated interaction with the login flow. The issue is resolved in version 3.2.2.
Affected products
- Apache Airflow 3.0.0 to 3.2.1
Timeline
- 2026-04-23: patched: Fix merged into main branch via Pull Request 65557
- 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub Advisory and NVD entry published