https://seclists.org/oss-sec/2026/q3/850: CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bear header, enabling session fixation

Q: Which deployments are realistically exposed to exploitation?

Apache Airflow 3.3.0 and 3.3.1 deployments whose UI is hosted on a domain shared with other applications are the most exposed. A deployment on a dedicated domain with no co-hosted applications is not reachable through the described cookie-placement methods.

Q: What does an attacker need to exploit this issue?

The attacker must first place a valid session cookie belonging to the attacker into the victim's browser or client. Described paths include cookie tossing from a sibling subdomain, cross-site scripting in another application sharing the parent domain, or use of a shared workstation.

Q: What happens when both authentication mechanisms are present?

The core API uses the session cookie's principal and ignores the explicitly supplied bearer token. The request executes and is recorded in the audit log as the cookie-derived identity, causing principal confusion and misattributed audit records.

Q: Are earlier Apache Airflow releases affected?

No. Earlier releases do not contain the code path that caches the cookie-derived user and are not vulnerable.

Published Sep 21, 2026

Updated

Affected Software

1 affected component

Apache Airflow>3.3.0<=3.3.1

Frequently Asked Questions

Which deployments are realistically exposed to exploitation?

Apache Airflow 3.3.0 and 3.3.1 deployments whose UI is hosted on a domain shared with other applications are the most exposed. A deployment on a dedicated domain with no co-hosted applications is not reachable through the described cookie-placement methods.

What does an attacker need to exploit this issue?

The attacker must first place a valid session cookie belonging to the attacker into the victim's browser or client. Described paths include cookie tossing from a sibling subdomain, cross-site scripting in another application sharing the parent domain, or use of a shared workstation.

What happens when both authentication mechanisms are present?

The core API uses the session cookie's principal and ignores the explicitly supplied bearer token. The request executes and is recorded in the audit log as the cookie-derived identity, causing principal confusion and misattributed audit records.

Are earlier Apache Airflow releases affected?

No. Earlier releases do not contain the code path that caches the cookie-derived user and are not vulnerable.