Vulnerabilities

TI-2026-59167 CVE-2026-86473 · GHSA-9cmm-29p3-73gr

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

MEDIUM 49

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00747 Published 2026-09-21 Fixed in 3.3.2 CWE-613

TI-2026-52806 CVE-2026-75158 · GHSA-pfr9-65p3-w9r9

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

LOW 21

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00636 Published 2026-09-21 Fixed in 3.0.0, 3.3.2 CWE-200

TI-2026-56785 CVE-2026-82355 · GHSA-9x6g-jfj6-r3jg

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

LOW 21

When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precede…

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00735 Published 2026-09-21 Fixed in 3.3.2 CWE-384

Vulnerabilities

Filters

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation