CVE-2026-28779: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-28779 is a session token exposure vulnerability in Apache Airflow where the _token cookie is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This misconfiguration allows any co-hosted application under the same domain to capture valid Airflow session tokens from HTTP request headers, enabling full session takeover without directly attacking Airflow. Affected versions are Apache Airflow 3.0.0 through 3.1.7; the fix is included in version 3.1.8 and later. The vulnerability was disclosed on March 17, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Openwall oss-sec, GitHub PR, Red Hat Advisory).

The root cause is classified as CWE-668 (Exposure of Resource to Wrong Sphere): the Airflow session cookie _token is always scoped to the root path / of the domain, ignoring any configured subpath via base_url. When Airflow is deployed at a subpath (e.g., /team-a), the cookie is still sent to all other applications sharing the same domain, because browsers transmit cookies matching the path prefix. A malicious or compromised co-hosted application can passively read the _token value from incoming HTTP request headers without any interaction from the Airflow server itself. The fix, implemented in PR #62771, scopes the cookie path to the configured base_url subpath rather than defaulting to / (GitHub PR, Openwall oss-sec).

Successful exploitation allows an attacker controlling or monitoring a co-hosted application on the same domain to capture valid Airflow session tokens, resulting in full session takeover and unauthorized administrative access to the Airflow instance. The confidentiality impact is high, as session tokens grant access to DAG configurations, pipeline data, credentials stored in connections, and potentially sensitive orchestration logic. Integrity and availability are not directly impacted by the vulnerability itself, but an attacker with a hijacked admin session could modify or delete DAGs, connections, and variables (Openwall oss-sec, Red Hat Advisory).

1. Reconnaissance: Identify Apache Airflow instances (versions 3.0.0–3.1.7) deployed at a subpath under a shared domain (e.g., https://example.com/airflow), where other applications are also hosted under https://example.com/.
2. Position on shared domain: Gain control of or access to another web application hosted on the same domain (e.g., https://example.com/other-app), which receives HTTP requests from users who are also authenticated to Airflow.
3. Capture session token: Because the Airflow _token cookie is scoped to path=/, browsers will include it in requests to all paths on the domain, including the co-hosted application. Log or intercept incoming HTTP request headers to extract the _token cookie value from authenticated Airflow users.
4. Session takeover: Use the captured _token cookie value in HTTP requests to the Airflow API or web UI (e.g., set Cookie: _token=<captured_value> in requests to https://example.com/airflow/api/v1/...) to authenticate as the victim user.
5. Achieve objective: With a valid session, access DAGs, connections, variables, and administrative functions within Airflow, or escalate further by modifying pipeline configurations (GitHub PR, Openwall oss-sec).

• Network: Unexpected or anomalous HTTP requests to Airflow API endpoints or the web UI originating from unusual IP addresses or user agents not associated with known Airflow clients; requests carrying a valid _token cookie from sources that have not previously authenticated to Airflow.
• Logs: Airflow access logs showing authenticated API or UI activity from IP addresses or sessions inconsistent with the legitimate user's normal access patterns; multiple sessions active simultaneously for the same user account from different IPs.
• Application: Unexpected changes to DAG definitions, Airflow connections, variables, or user accounts that cannot be attributed to known administrators; new or modified connections containing credentials that were not configured by authorized users.

The primary remediation is to upgrade Apache Airflow to version 3.1.8 or later, which scopes the _token session cookie to the configured base_url subpath rather than / (GitHub PR, Openwall oss-sec). As a workaround for environments that cannot immediately upgrade, avoid co-hosting untrusted or third-party applications on the same domain as Airflow, or deploy Airflow on a dedicated domain or subdomain to eliminate the shared-cookie attack surface. Additionally, review recent Airflow session activity and audit access logs for signs of unauthorized access, and consider invalidating existing sessions after upgrading (Red Hat Advisory).

The vulnerability was discovered and reported by Daniel Wolf, who also developed the remediation patch submitted via GitHub PR #62771, which was reviewed and merged by Apache Airflow maintainers (GitHub PR). The disclosure was made through the oss-security mailing list on March 17, 2026, and the fix was backported to the v3-1 maintenance branch for inclusion in Airflow 3.1.8 (Openwall oss-sec). Community reaction has been generally positive toward the fix, with maintainers describing it as a "high quality PR." No significant broader media coverage or threat actor commentary has been identified.