CVE-2026-28779: Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
Apache Airflow versions 3.1.0 through 3.1.7 session token (token) in cookies is set to path=/ regardless of the configured [webserver] baseurl or [api] baseurl. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28779?
CVE-2026-28779 is considered a high severity vulnerability due to its potential for session hijacking.
How do I fix CVE-2026-28779?
To fix CVE-2026-28779, upgrade Apache Airflow to version 3.1.8 or later, where the issue has been addressed.
What versions of Apache Airflow are affected by CVE-2026-28779?
CVE-2026-28779 affects Apache Airflow versions 3.1.0 through 3.1.7.
How does CVE-2026-28779 enable session hijacking?
CVE-2026-28779 allows session hijacking because the session token in cookies is set to a path that does not respect the configured base_url.
What components are involved in the CVE-2026-28779 vulnerability?
CVE-2026-28779 specifically involves the webserver and API components of Apache Airflow.