CVE-2026-28779: Apache Airflow Auth Bypass Vulnerability

CVE-2026-28779 Overview

A session hijacking vulnerability has been identified in Apache Airflow versions 3.1.0 through 3.1.7. The vulnerability stems from improper cookie path configuration where the session token (_token) is set to path=/ regardless of the configured [webserver] base_url or [api] base_url settings. This misconfiguration allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, enabling full session takeover without directly attacking the Airflow application itself.

Critical Impact

Attackers can hijack authenticated Airflow sessions by capturing session tokens through co-hosted applications on the same domain, potentially gaining full administrative access to workflow orchestration systems.

Affected Products

• Apache Airflow versions 3.1.0 through 3.1.7

Discovery Timeline

• 2026-03-17 - CVE-2026-28779 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-28779

Vulnerability Analysis

This vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere), representing an improper resource exposure flaw in Apache Airflow's session management implementation. The core issue lies in the webserver's cookie configuration logic that fails to respect the administrator-defined base_url settings when setting the session token cookie path.

When Airflow administrators configure a specific base URL path for their deployment (for example, /airflow/ instead of the root path), they typically expect session cookies to be scoped to that specific path. However, due to this vulnerability, the session token cookie is always set with path=/, making it accessible to any application hosted on the same domain.

The impact of this vulnerability is significant in multi-tenant or shared hosting environments where multiple applications run under the same domain. An attacker controlling or compromising any co-hosted application can passively collect Airflow session tokens transmitted in HTTP headers, leading to complete session takeover and unauthorized access to the Airflow web interface and API.

Root Cause

The root cause is a hardcoded cookie path value in the session management component. Instead of dynamically setting the cookie path based on the configured [webserver] base_url or [api] base_url parameters, the implementation unconditionally sets path=/ for the _token session cookie. This design flaw violates the principle of least privilege for cookie scope and creates an unnecessary exposure surface in shared hosting environments.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker needs to have control over or access to any application running on the same domain as the Airflow instance. The attack flow involves:

1. The attacker deploys or compromises a co-hosted application on the same domain as Apache Airflow
2. Legitimate users authenticate to Airflow, receiving session tokens with overly permissive path=/ scope
3. When users browse to any path on the domain (including attacker-controlled applications), the browser automatically includes the Airflow session token in request headers
4. The attacker's application captures these session tokens
5. The attacker uses stolen tokens to impersonate authenticated users and gain full access to Airflow

The vulnerability does not require any direct interaction with the Airflow application itself, making it particularly dangerous in environments where domain isolation between applications is not enforced.

Detection Methods for CVE-2026-28779

Indicators of Compromise

• Unusual session activity from IP addresses not typically associated with legitimate Airflow users
• Multiple concurrent sessions using the same session token from different geographic locations
• Access to Airflow administrative functions from unexpected network segments
• Session tokens appearing in access logs of co-hosted applications on the same domain

Detection Strategies

• Implement monitoring for session token reuse across different client IP addresses or user agents
• Deploy web application firewalls (WAF) with rules to detect session token leakage patterns
• Enable verbose logging on the Airflow webserver to track authentication events and session creation
• Monitor for anomalous API access patterns that may indicate hijacked sessions

Monitoring Recommendations

• Configure alerts for authentication anomalies such as rapid session creation or concurrent logins
• Implement network segmentation monitoring to detect cross-application token exposure
• Review access logs of all co-hosted applications for presence of Airflow session tokens
• Establish baseline user behavior patterns to identify potential session hijacking incidents

How to Mitigate CVE-2026-28779

Immediate Actions Required

• Upgrade Apache Airflow to version 3.1.8 or later immediately
• Review and audit all applications co-hosted on the same domain as Airflow deployments
• Invalidate all existing session tokens by restarting the Airflow webserver and forcing re-authentication
• Consider implementing additional session binding mechanisms such as IP address verification
• Isolate Airflow on a dedicated subdomain if upgrade is not immediately possible

Patch Information

Apache has released version 3.1.8 which resolves this session token exposure vulnerability. The fix ensures that the session cookie path is correctly set based on the configured [webserver] base_url and [api] base_url parameters. Details of the patch can be found in the Apache Airflow GitHub Pull Request and the Apache Mailing List Thread.

Workarounds

• Deploy Airflow on a dedicated subdomain (e.g., airflow.example.com) to prevent cookie sharing with other applications
• Implement a reverse proxy configuration that strips or validates session cookies at the domain boundary
• Enable additional authentication layers such as mutual TLS or IP-based access restrictions
• Use network segmentation to isolate Airflow from other applications at the infrastructure level

# Example: Configure Airflow on a dedicated subdomain via reverse proxy
# nginx configuration snippet for domain isolation
server {
    server_name airflow.example.com;
    
    location / {
        proxy_pass http://airflow-backend:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_cookie_path / "/; SameSite=Strict; Secure";
    }
}