CVE-2026-28779 json
Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
published 7mo ago modified 6d ago also BIT-airflow-2026-28779 , EUVD-2026-12558 , GHSA-4fhm-p86v-hwpx , PYSEC-2026-16
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.
Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Patch / fix
- pypi apache-airflow 3.1.8
- bitnami airflow 3.1.8
- Apache Software Foundation Apache Airflow 3.1.8
- github.com/apache/airflow#62771 pull request
Is CVE-2026-28779 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7mo ago
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow | >=3.0.0, <3.1.8 |
3.1.8 |
| bitnami | airflow | >=3.0.0, <3.1.8 |
3.1.8 |
Affected products
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-668 Exposure of Resource to Wrong Sphere
References
-
github.com
/apache/airflow/pull/62771
patch, web, issue-tracking
-
lists.apache.org
/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/03/17/3
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-28779
advisory, web
-
github.com
/apache/airflow
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-16.yaml
web
-
github.com
/advisories/GHSA-4fhm-p86v-hwpx
advisory
Sources
- CVE List CVE-2026-28779
- GitHub Advisory GHSA-4fhm-p86v-hwpx
- NVD CVE-2026-28779
- OSV BIT-airflow-2026-28779
- OSV PYSEC-2026-16
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.