CVE-2026-82355
Received Received - Intake

Authentication Bypass via Session Cookie in Apache Airflow

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Apache Software Foundation

Description
When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the identity the client explicitly presented. Only Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier releases do not contain the code path that caches the cookie-derived user, and are not vulnerable. Exploiting this requires an attacker to first place a valid session cookie of their own into the victim's browser or client: for example by cookie tossing from a sibling subdomain, through cross-site scripting in a separate application sharing a parent domain, or via a shared workstation. Deployments that host the Airflow UI on a domain shared with other applications are therefore the most exposed; a deployment on a dedicated domain with no co-hosted applications is not reachable this way. The consequence is principal confusion and misattributed audit records rather than a direct privilege escalation. Users of 3.3.0 or 3.3.1 should upgrade to Apache Airflow 3.3.2 or later, which resolves the caller from the explicitly supplied credential whenever one is present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-82355
EUVD
EUVD-2026-83943

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache airflow to 3.3.2 (exc)
apache airflow 3.3.0
apache airflow 3.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Apache Airflow versions 3.3.0 and 3.3.1. When a request includes both a session cookie and an explicit Authorization Bearer token, Airflow incorrectly uses the user identity from the cookie instead of the token. This causes the request to execute and be logged under the cookie's user rather than the token's user, leading to principal confusion and misattributed audit records.

Detection Guidance

To detect this vulnerability, check if your Apache Airflow version is 3.3.0 or 3.3.1. Run: airflow version. If affected, inspect API requests for both session cookies and Authorization: Bearer headers to see if the cookie identity is incorrectly used instead of the bearer token.

Impact Analysis

An attacker could exploit this by placing a valid session cookie in a victim's browser through methods like cookie tossing or cross-site scripting. This would cause actions performed by the victim to be logged under the attacker's identity, creating confusion in audit trails. However, direct privilege escalation is not possible through this vulnerability alone.

Compliance Impact

This vulnerability could impact compliance by causing incorrect audit logging. Actions performed by legitimate users might be attributed to attackers, leading to inaccurate records of who performed specific actions. This could affect accountability and traceability required by standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade Apache Airflow to version 3.3.2 or later immediately. This resolves the credential precedence issue by ensuring explicit tokens take priority over session cookies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart