Security Flaw in Apache Airflow Related to JWT Auth Cookie Maintenance

CVE-2026-41017

What is CVE-2026-41017?

The JWTRefreshMiddleware in Apache Airflow has a flaw where it sets the JWT authentication cookie without the 'Secure' flag. This weakens the session integrity, particularly for setups where the Airflow API server operates behind an HTTPS-terminating reverse proxy (like nginx or Envoy). Attackers positioned on the network could exploit this flaw by inducing a logged-in user's browser to make an HTTP request. This would allow them to capture the JWT cookie from the request, subsequently leading to unauthorized access to the API. Organizations using affected versions are encouraged to upgrade to Apache Airflow 3.2.2 or later to mitigate this risk.

References