Database/Control plane, storage & DevOps
Apache Airflow: login redirect route can be crafted to send users to an attacker-controlled origin
Impact
The login redirect route accepted next= values that slipped past the is_safe_url check, so a link that starts on the trusted Airflow hostname lands the user on an origin the attacker controls. For an operator this is a phishing primitive against the people who hold Airflow credentials - the pipeline operators and platform engineers whose accounts can schedule work on the fleet - not a direct compromise of the scheduler or of any node. Impact is confined to the web tier; nothing here gives code execution or data access by itself.
Who can reach it
Anyone who can get an authenticated Airflow user to click a crafted URL on the Airflow domain. The description notes the bypass is reachable by authenticated users; the CVSS vector records PR:N.
What to do
Upgrade apache-airflow to 3.2.2 or later and restart the webserver. As defense in depth, the advisory suggests a reverse proxy in front of Airflow that strips off-domain next= query parameters before they reach the login endpoint - deployable without an Airflow restart.
References
Related entries
- Dell OpenManage Enterprise: unauthenticated SSRF reaches services on the management networkCVE-2026-54794 · Dell OpenManage Enterprise (web interface)High
- Dell OpenManage Enterprise: privileged user can inject OS commands and run code on the applianceCVE-2026-54796 · Dell OpenManage Enterprise (OS command handling)High
- Ivanti Endpoint Manager Mobile: Improper input validationCVE-2026-6973 · Ivanti Endpoint Manager MobileHigh
- Dell OpenManage Enterprise: improper privilege management lets a privileged account escalate furtherCVE-2026-70421 · Dell OpenManage Enterprise (privilege management)High
- Pandora FMS: blind SQL injection through the module parameter of the Grafana datasource endpointCVE-2026-75786 · Pandora FMS (Grafana datasource endpoint, module parameter)High
- MongoDB Server: use-after-free in query memory tracking crashes or corrupts the server processCVE-2026-82061 · MongoDB Server (query execution memory tracking)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.