affected:
- package:
    ecosystem: PyPI
    name: apache-airflow
    purl: pkg:pypi/apache-airflow
  ranges:
  - events:
    - introduced: 3.0.0
    - fixed: 3.1.8
    type: ECOSYSTEM
  versions:
  - 3.0.0
  - 3.0.1
  - 3.0.1rc1
  - 3.0.2
  - 3.0.2rc1
  - 3.0.2rc2
  - 3.0.3
  - 3.0.3rc1
  - 3.0.3rc2
  - 3.0.3rc3
  - 3.0.3rc4
  - 3.0.3rc5
  - 3.0.3rc6
  - 3.0.4
  - 3.0.4rc1
  - 3.0.4rc2
  - 3.0.5
  - 3.0.5rc1
  - 3.0.5rc2
  - 3.0.5rc3
  - 3.0.6
  - 3.0.6rc1
  - 3.0.6rc2
  - 3.1.0
  - 3.1.0b1
  - 3.1.0b2
  - 3.1.0rc1
  - 3.1.0rc2
  - 3.1.1
  - 3.1.1rc1
  - 3.1.1rc2
  - 3.1.2
  - 3.1.2rc1
  - 3.1.2rc2
  - 3.1.3
  - 3.1.3rc1
  - 3.1.4
  - 3.1.4rc1
  - 3.1.4rc2
  - 3.1.5
  - 3.1.5rc1
  - 3.1.6
  - 3.1.6rc1
  - 3.1.7
  - 3.1.7rc1
  - 3.1.7rc2
  - 3.1.8rc1
  - 3.1.8rc2
aliases:
- CVE-2026-28779
- GHSA-4fhm-p86v-hwpx
details: "Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies
  is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\n
  This allows any application co-hosted under the same domain to capture valid Airflow
  session tokens from HTTP request headers, allowing full session takeover without
  attacking Airflow itself.\n\nUsers are recommended to upgrade to Apache Airflow
  3.1.8 or later, which resolves this issue."
id: PYSEC-2026-16
modified: '2026-05-20T09:18:53.041032Z'
published: '2026-03-17T11:16:11.790Z'
references:
- type: ADVISORY
  url: http://www.openwall.com/lists/oss-security/2026/03/17/3
- type: ADVISORY
  url: https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
- type: FIX
  url: https://github.com/apache/airflow/pull/62771
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4fhm-p86v-hwpx
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3