CVE-2026-40961
Open Redirect Vulnerability in Apache Airflow
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | apache_airflow | From 3.2.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability in Apache Airflow involves a flaw in the login redirect route where authenticated users could craft URLs that bypass the `is_safe_url` check.
Specifically, the issue was that URLs containing triple forward slashes (`///`) or similar special character prefixes were treated as safe due to how the JavaScript URL constructor parses URLs according to WHATWG standards.
This allowed attackers to redirect users from a trusted Airflow domain to an attacker-controlled origin.
How can this vulnerability impact me? :
The vulnerability can lead to malicious redirection attacks where users are redirected from the trusted Airflow domain to potentially harmful external sites controlled by attackers.
This could be exploited to perform phishing attacks, steal user credentials, or deliver malicious payloads by tricking users into trusting the redirected URL.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are advised to upgrade Apache Airflow to version 3.2.2 or later.
As a defense-in-depth measure, deployment operators can place Airflow behind a reverse proxy that strips off-domain 'next=' query parameters before they reach the login endpoint.