Login Redirect Bypass Vulnerability in Apache Airflow

CVE-2026-40961

What is CVE-2026-40961?

A vulnerability in the login redirect route of Apache Airflow permits authenticated users to intentionally create URLs that can bypass the is_safe_url security check. This flaw enables redirection from a legitimate Airflow domain to a malicious site controlled by an attacker. To mitigate this risk, users are strongly encouraged to upgrade to Apache Airflow version 3.2.2 or higher. Additionally, it is advisable to deploy Airflow behind a reverse proxy that removes off-domain next= query parameters before the request hits the login endpoint.

References