CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

As cited

Copy frozen at 2026-09-21 19:19 UTC (site build).

vulnerabilities

CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow 3.3.0 through 3.3.1 silently prioritizes session cookies over explicit Authorization bearer tokens in application programming interface (API) requests, allowing an attacker to hijack a session by fixing a cookie while bypassing the intended bearer token authentication. The vulnerability enables an authenticated attacker to execute API calls as a different user whose session cookie they control. Airflow records these actions in the audit log under the cookie's principal identity rather than the bearer token's claimed identity.

Why it matters: Organizations running Airflow 3.3.0 or 3.3.1 should upgrade to 3.3.2 immediately; an attacker with knowledge of a valid session cookie can impersonate that user in API calls, bypassing bearer token authentication and leaving misleading audit trails.

Source published

2026-09-21 17:14 UTC

First seen by Cybersecurity Tracker

2026-09-21 18:13 UTC