CVE-2026-82355: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-82355 is a session fixation / credential precedence inversion vulnerability in Apache Airflow's core API that allows a session cookie to silently override an explicit Authorization: Bearer token, causing API requests to execute under the wrong principal identity. Only Apache Airflow versions 3.3.0 and 3.3.1 are affected; earlier releases do not contain the vulnerable code path. The vulnerability was disclosed on September 21, 2026, with a patch released in Apache Airflow 3.3.2. It carries a CVSS v3.1 base score of 4.2 (Moderate) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-384 (Session Fixation). In the affected versions, JWTRefreshMiddleware runs before get_user() and resolves a user from the _token session cookie alone, stamping the result on request.state with a trust sentinel. When get_user() is subsequently called, it returns this cached cookie-derived user immediately — before evaluating any Authorization: Bearer or OAuth2 token — inverting the intended credential precedence. The fix (PR #72225) restricts the cached-user path to requests that carry no explicit credential, ensuring bearer and OAuth2 tokens are resolved first when present (GitHub PR #72225). Exploitation requires an attacker to first inject a valid session cookie of their own into the victim's browser or API client via cookie tossing from a sibling subdomain, XSS in a co-hosted application, or physical access to a shared workstation (Apache Advisory).

The primary consequence is principal confusion: API requests execute and are recorded in the audit log under the attacker's identity (from the injected cookie) rather than the victim's explicitly presented bearer token identity. This results in misattributed audit records and potential integrity impact on actions performed via the API. The vulnerability does not constitute a direct privilege escalation, and availability is unaffected; confidentiality and integrity impacts are rated Low. Deployments hosting the Airflow UI on a domain shared with other applications are most exposed, while isolated single-domain deployments face significantly reduced risk (Apache Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.265% (Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-trivial, requiring high attack complexity, user interaction, and a prerequisite ability to inject a valid session cookie into the victim's client environment (GitHub Advisory).

1. Identify target deployment: Confirm the target is running Apache Airflow 3.3.0 or 3.3.1 and that the Airflow UI is hosted on a domain shared with other applications (e.g., airflow.example.com alongside app.example.com).
2. Obtain a valid attacker session cookie: Authenticate to the Airflow instance as the attacker to obtain a valid _token JWT session cookie.
3. Inject the cookie into the victim's browser or client: Use one of the following techniques:
   • Cookie tossing: From a sibling subdomain (e.g., sibling.example.com), set a cookie scoped to .example.com that overwrites the victim's Airflow session cookie.
   • XSS in co-hosted application: Exploit a cross-site scripting vulnerability in another application sharing the parent domain to inject the attacker's cookie into the victim's browser.
   • Shared workstation: Directly plant the cookie in a browser profile on a shared machine.
4. Trigger a victim API request: Wait for or cause the victim to make an API request to the Airflow core API that includes both the injected session cookie and their own Authorization: Bearer <victim_token> header.
5. Observe misattribution: The API request executes under the attacker's identity (from the cookie) rather than the victim's bearer token. Actions performed and audit log entries are recorded as the attacker's principal, obscuring the true actor (Apache Advisory, GitHub PR #72225).

• Logs: Audit log entries in Airflow showing API actions attributed to one user identity while the corresponding HTTP request carried a bearer token belonging to a different user; discrepancies between the Authorization: Bearer token subject and the logged principal in airflow.log or the audit trail.
• Network: HTTP requests to Airflow core API endpoints containing both a Cookie: _token=<jwt> header and an Authorization: Bearer <token> header where the two JWTs resolve to different user identities.
• Logs: Unexpected or anomalous API actions (DAG triggers, variable modifications, connection changes) recorded under a user account that did not initiate the corresponding client session.
• Network: Cookie-setting requests originating from sibling subdomains or co-hosted applications targeting the parent domain's cookie scope shortly before anomalous Airflow API activity.

Upgrade Apache Airflow to version 3.3.2 or later, which corrects the credential resolution order so that an explicit bearer or OAuth2 token always takes precedence over a cached cookie-derived user (Apache Advisory, GitHub PR #72225). For deployments that cannot immediately patch, isolate the Airflow UI on a dedicated domain with no co-hosted applications to eliminate the cookie injection attack surface. Additionally, enforce strict SameSite=Strict or SameSite=Lax cookie attributes and implement strong session management controls to reduce the risk of cookie tossing or XSS-based cookie injection.

The Apache Software Foundation issued a security advisory on September 21, 2026, and the fix was backported to the v3-3-test branch for inclusion in the 3.3.2 release (Apache Advisory). The vulnerability was also disclosed via the oss-security mailing list. The NixOS security tracker opened and subsequently closed a tracking issue for apache-airflow < 3.3.2, indicating prompt downstream packaging response. Community reaction has been measured given the moderate severity and the non-trivial exploitation prerequisites.