Executive brief
Apache Airflow's core API incorrectly prioritizes session cookies over explicit authentication tokens when both are present in a request, causing the system to authenticate the request under the wrong user identity. An attacker must first place a malicious session cookie into a victim's browser—possible through cross-site scripting or cookie tossing—then make an API request that carries both the attacker's cookie and a legitimate Authorization token. The result is that API calls execute and are audited under the attacker's identity rather than the legitimate user's, leading to misattributed actions and false audit trails.
Technical details
The vulnerability stems from incorrect credential resolution logic in Airflow 3.3.0 and 3.3.1, where session cookies are resolved and cached before checking for explicit Bearer tokens, causing the bearer token to be silently ignored. The attack requires pre-existing placement of a valid session cookie in the victim's client—typically via XSS, cookie tossing from a sibling domain, or local access. This results in principal confusion and audit log misattribution; it does not grant direct privilege escalation. The fix (merged in PR #72225) ensures explicit credentials are resolved with priority over session cookies.
Affected products
- Apache Airflow 3.3.0, 3.3.1
Timeline
- 2026-09-21: disclosed
- 2026-09-08: patched: Fix merged in PR #72225 to apache:main