Database/Control plane, storage & DevOps
Apache Airflow: session cookie is set at path=/ regardless of base_url, enabling cross-app takeover
Impact
Airflow 3.1.0 through 3.1.7 sets the _token session cookie with path=/ even when the webserver or API is mounted under a sub-path via base_url. Any other application served from the same domain - a Grafana, a notebook proxy, a team dashboard sharing the cluster ingress hostname - receives valid Airflow session tokens in its own request headers and can replay them for full session takeover. This is the normal arrangement on a GPU cluster that fronts several internal tools behind one hostname with path routing, and it requires no flaw in Airflow itself to exploit; whoever controls or compromises a co-hosted path inherits Airflow sessions, including those of admins.
Who can reach it
Anyone who controls or can read requests to any application co-hosted on the same domain as Airflow, once an authenticated Airflow user's browser visits it. No Airflow credentials needed.
What to do
Upgrade to Apache Airflow 3.1.8 or later and restart the API server/webserver; existing sessions should be invalidated afterwards. Until then, move Airflow to its own hostname rather than a shared-domain sub-path, so the cookie cannot be sent to a neighbouring app.
References
Related entries
- Apache Airflow: SQL error stack traces returned by the API despite expose_stack_traces=falseCVE-2026-30912 · Apache Airflow API (SQL error handling)High
- Apache Airflow: task JWT tokens written to logs let UI users act as Dag authorsCVE-2026-31987 · Apache Airflow (task JWT tokens in logs)High
- Apache Airflow: asset materialize permission lets a user trigger DAGs they have no access toCVE-2026-32228 · Apache Airflow (asset materialize permission)High
- Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trust: This is the vendor formally concedingCVE-2026-32666 · Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trustHigh
- Apache Tomcat: Missing encryption of sensitive data introduced by the CVE-2026-29146 fixCVE-2026-34486 · Apache TomcatHigh
- Apache Airflow: bulk Task Instance API authorizes the URL dag_id but acts on the body dag_idCVE-2026-41084 · Apache Airflow (bulk Task Instances API, PATCH/DELETE authorization)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.