CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
Apache Airflow lets a session cookie override a bearer token, enabling session fixation.
CVE-2026-82355 affects Apache Airflow 3.3.0 before 3.3.2 and is rated low. If a core API request carries both a session cookie and an Authorization bearer token, Airflow authenticates the cookie principal and ignores the bearer token, reversing the intended precedence. The request executes and is audit-logged as the cookie identity, which the advisory describes as enabling session fixation. No active exploitation is reported.
- Low-severity flaw in Airflow 3.3.0 before 3.3.2.
- A session cookie overrides an explicit bearer token.
- Requests and audit logs use the cookie principal.
- The advisory links the behavior to session fixation.
Vulnerabilities mentionedAll →
- CVE-2026-823554.2—Session Cookie Overrides Bearer Token in Apache Airflow 3.3.0–3.3.1published · Apache Airflow
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82355 | Session Cookie Overrides Bearer Token in Apache Airflow 3.3.0–3.3.1 In Apache Airflow 3.3.0 and 3.3.1, a request to the core API that carries both a session cookie and an explicit Authorization: Bearer token is resolved from the cookie, inverting the intended bearer-over-cookie precedence. An attacker who can first plant one of their own valid session cookies into the victim's browser or client — for example via cookie tossing from a sibling subdomain, XSS in another application sharing a parent domain, or a shared workstation — causes the request to execute and be audit-logged as the attacker's principal rather than the identity the client explicitly presented. The impact is principal confusion and misattributed audit records, not a direct privilege escalation, and deployments on a dedicated domain with no co-hosted applications are not reachable via this path. No public proof of concept exists, the issue is not in the CISA KEV catalog, and no exploitation has been reported. |
Posted by Rahul Vats on Sep 21 Severity: low Affected versions: - Apache Airflow 3.3.0 before 3.3.2 Description: When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the...
This source does not provide full text. Read it at seclists.org.