CVE-2026-28779

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28779", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-03T10:12:24.113Z", "datePublished": "2026-03-17T10:15:59.132Z", "dateUpdated": "2026-11-03T06:53:11.119Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:53:11.119Z"}, "title": "Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications", "problemTypes": [{"descriptions": [{"description": "CWE-668: Exposure of Resource to Wrong Sphere", "lang": "en", "cweId": "CWE-668", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "collectionURL": "https://pypi.python.org", "packageName": "apache-airflow-core", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.8", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:pypi/apache-airflow-core"}], "descriptions": [{"value": "Apache Airflow versions 3.1.0 through 3.1.7\u00a0session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\nThis allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.\n\nUsers are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Apache Airflow versions 3.1.0 through 3.1.7&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.<br><p>This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.</p></span>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br>"}]}], "references": [{"url": "https://github.com/apache/airflow/pull/62771", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "Medium"}}}], "credits": [{"lang": "en", "value": "Daniel Wolf", "type": "finder"}, {"lang": "en", "value": "Daniel Wolf", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-17T13:32:03.724Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:44:27.820701Z", "id": "CVE-2026-28779", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:45:02.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-17T13:32:03.724Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-28779", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T13:44:27.820701Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:44:37.203Z"}}], "cna": {"title": "Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Daniel Wolf"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Wolf"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "Medium"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.8", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-core", "packageName": "apache-airflow-core", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/62771", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Airflow versions 3.1.0 through 3.1.7\u00a0session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\nThis allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.\n\nUsers are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.", "supportingMedia": [{"type": "text/html", "value": "Apache Airflow versions 3.1.0 through 3.1.7&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.<br><p>This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.</p></span>Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-03T06:53:11.119Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28779", "state": "PUBLISHED", "dateUpdated": "2026-11-03T06:53:11.119Z", "dateReserved": "2026-03-03T10:12:24.113Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-03-17T10:15:59.132Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-core", "packageURL": "pkg:pypi/apache-airflow-core", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.1.8", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "A355B3D5-BAA7-4680-879B-55D6E3D52D68", "versionEndExcluding": "3.1.8", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Airflow versions 3.1.0 through 3.1.7\u00a0session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\nThis allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.\n\nUsers are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue."}, {"lang": "es", "value": "El token de sesi\u00f3n (_token) en las cookies de las versiones de Apache Airflow 3.1.0 a 3.1.7 se establece en path=/ independientemente de la base_url configurada para [webserver] o [api].\nEsto permite a cualquier aplicaci\u00f3n co-alojada bajo el mismo dominio capturar tokens de sesi\u00f3n de Airflow v\u00e1lidos de los encabezados de las solicitudes HTTP, lo que permite una toma de control completa de la sesi\u00f3n sin atacar a Airflow directamente.\n\nSe recomienda a los usuarios actualizar a Apache Airflow 3.1.8 o posterior, lo que resuelve este problema."}], "id": "CVE-2026-28779", "lastModified": "2026-11-03T07:18:57.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28779", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:44:27.820701Z", "version": "2.0.3"}}]}, "published": "2026-03-17T11:16:11.790", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/airflow/pull/62771"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/17/3"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.1.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Airflow", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "airflow", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-03-17T18:51:18.829878+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Airflow to version 3.1.8 or newer, which resolves the cookie path issue."], "summary": {"action": "Immediate Patch", "impact": "Session Hijacking"}, "threat_synthesis": {"affected_systems": "Known affected vendor: Apache Software Foundation \u2013 Apache Airflow. Impacted releases are 3.1.0 through 3.1.7. No information is provided about older versions or higher major releases, nor for other vendors\u2019 products.", "description_and_impact": "Apache Airflow versions 3.1.0 through 3.1.7 set the session token cookie (_token) to path=\u2019/\u2019 regardless of the configured base_url. Key detail from the CVE description: this oversight allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, resulting in session hijacking. The vulnerability is classified as CWE-668 (Improper Limit on a Functionality). The impact is that an attacker who obtains a legitimate session token can perform actions on behalf of the authenticated user, potentially modifying workflows, accessing sensitive data, or escalating privileges.", "risk_and_exploitability": "CVSS score of 7.5 indicates high severity. EPSS score is listed as <1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack requires a co-hosted application on the same top-level domain, which is a reasonably achievable condition in shared hosting environments. An attacker can collect the cookie from incoming request headers and reuse the token to hijack an Airflow session."}}}}, "created": "2026-03-18T12:13:30.192925+00:00", "updated": "2026-03-24T10:49:25.449174+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}