CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
Apache Airflow lets a session cookie override a bearer token, enabling session fixation.
CVE-2026-82355 affects Apache Airflow 3.3.0 before 3.3.2 and is rated low. If a core API request carries both a session cookie and an Authorization bearer token, Airflow authenticates the cookie principal and ignores the bearer token, reversing the intended precedence. The request executes and is audit-logged as the cookie identity, which the advisory describes as enabling session fixation. No active exploitation is reported.
- Low-severity flaw in Airflow 3.3.0 before 3.3.2.
- A session cookie overrides an explicit bearer token.
- Requests and audit logs use the cookie principal.
- The advisory links the behavior to session fixation.
- CVEs
- CVE-2026-82355
- Vendors
- Apache
- Products
- Apache Airflow
- Organizations
- Apache
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82355 | Session Cookie Overrides Bearer Token in Apache Airflow 3.3.0–3.3.1 | 4.2 | — |
From the original article
Posted by Rahul Vats on Sep 21 Severity: low Affected versions: - Apache Airflow 3. 3. 0 before 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.