Session Cookie Vulnerability in Apache Airflow API

CVE-2026-82355

What is CVE-2026-82355?

The Apache Airflow core API has a vulnerability that occurs when both a session cookie and a bearer token are present in a request. In this situation, Airflow prioritizes the session cookie, disregarding the bearer token, which is contrary to standard security practices. This flaw can lead to principal confusion, as the actions executed are logged under the identity derived from the cookie rather than the intended identity provided by the bearer token. Attackers can exploit this vulnerability by injecting a valid session cookie into a victim's browser, potentially through methods such as cookie tossing or cross-site scripting. Users of versions 3.3.0 and 3.3.1 are advised to upgrade to version 3.3.2 or later to address this security issue.

References