CVE-2026-28779 Apache Software Foundation CVE debrief

Who should care

Airflow administrators and users, security teams, developers hosting applications under the same domain as Airflow, and IT personnel responsible for vulnerability management and patching are all impacted by this vulnerability. These stakeholders should prioritize upgrading to Apache Airflow 3.1.8 or later and review session token configurations to mitigate potential risks. Additionally, security teams should monitor for suspicious session activity and plan

Why it matters

CVE-2026-28779 allows co-hosted applications to capture valid Airflow session tokens, enabling full session takeover without directly attacking Airflow. This vulnerability requires immediate attention from Airflow administrators and users to upgrade to version 3.1.8 or later.

• Session takeover risk for co-hosted applications
• Potential for unauthorized access to Airflow sessions
• Need for urgent upgrade to patched version
• Possible impact on security posture due to session vulnerability

Technical summary

Apache Airflow versions 3.1.0 through 3.1.7 have a session token (_token) in cookies set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This misconfiguration allows co-hosted applications to capture valid session tokens, potentially leading to full session takeover. The vulnerability requires immediate attention to upgrade to version 3.1.8 or later and review session configurations to prevent unauthorized access and control. Technical analysis indicates that this issue is a result of improper session token path configuration, which can be exploited by co-hosted applications to gain unauthorized access to Airflow sessions.

Defensive priority

Upgrade to Apache Airflow 3.1.8 or later to resolve session token vulnerability

Recommended defensive actions

• Upgrade to Apache Airflow 3.1.8 or later
• Review and adjust session token configurations to ensure secure path settings
• Monitor for suspicious session activity and implement additional logging
• Conduct a thorough review of co-hosted applications and their potential access to session tokens
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Perform a detailed security audit to identify any unauthorized access or suspicious activity

Evidence notes

Apache Airflow versions 3.1.0 through 3.1.7 have a session token (_token) in cookies set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows co-hosted applications to capture valid session tokens, potentially leading to full session takeover. Evidence from the CVE record and vendor advisories confirms this vulnerability, emphasizing the need for immediate upgrades and session configuration reviews.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.