Executive brief
Apache Airflow, a platform used to programmatically author and monitor workflows, contains a security flaw in how it handles user session cookies. When the software is used behind common web proxies or load balancers, it fails to properly protect authentication tokens, allowing them to be sent over unencrypted connections. A nearby attacker, such as someone on the same Wi-Fi network, could intercept these tokens to impersonate a user and gain unauthorized access to the Airflow API.
Technical details
Apache Airflow's JWTRefreshMiddleware incorrectly determines whether to set the 'Secure' attribute on JWT cookies based solely on local SSL configuration rather than the incoming request's protocol. In common cloud-native topologies where TLS is terminated at a reverse proxy (like Nginx or Envoy) and traffic is forwarded to Airflow as plaintext, the middleware omits the Secure flag. This allows a network-positioned attacker to capture the JWT via a Man-in-the-Middle (MITM) attack if the user's browser makes any cleartext HTTP request to the same host. The attacker can then replay the captured token to authenticate against the Airflow API. The issue is fixed in version 3.2.2 by ensuring the Secure flag is set if either the request is HTTPS or a local certificate is configured.
Affected products
- Apache Software Foundation Apache Airflow >= 3.0.0, < 3.2.2
Timeline
- 2026-04-16: patched: Pull request merged into main branch
- 2026-05-31: disclosed: Initial disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub and NVD advisories published