PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41017 Apache Software Foundation CVE debrief

Apache Airflow's JWTRefreshMiddleware fails to set the Secure flag on JWT authentication cookies, exposing session tokens to cleartext transmission in deployments using TLS-terminating reverse proxies. When the Airflow API server sits behind an HTTPS-terminating proxy (nginx, Envoy, managed load balancers) that forwards plaintext HTTP to the backend, the middleware's omission of the Secure attribute causes browsers to transmit the JWT cookie over any unencrypted HTTP connection to the same host. A network-positioned attacker—via Wi-Fi MITM, hostile LAN segment, or captive portal—can induce a logged-in user's browser to make an HTTP request to the deployment hostname, capture the JWT from the cleartext request, and replay it to authenticate against the API. The vulnerability specifically affects cloud-native topologies where TLS termination occurs at the proxy layer and the cookie's secure-by-default protection is relied upon for session integrity.

Vendor
Apache Software Foundation
Product
Apache Airflow
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Organizations running Apache Airflow behind TLS-terminating load balancers or reverse proxies, particularly in cloud-native deployments where the API server receives plaintext HTTP from the proxy tier. Security teams responsible for session management and infrastructure hardening in Airflow environments.

Technical summary

The JWTRefreshMiddleware in Apache Airflow sets authentication cookies without the Secure attribute. In deployments where a reverse proxy terminates TLS and communicates with the Airflow API server via HTTP, browsers will transmit these cookies over cleartext HTTP connections to the same host. This enables network-based attackers to capture and replay session JWTs for unauthorized API access.

Defensive priority

high

Recommended defensive actions

  • Upgrade to apache-airflow 3.2.2 or later to obtain the Secure flag fix for JWT authentication cookies
  • Verify that JWTRefreshMiddleware cookies include the Secure attribute after upgrade by inspecting Set-Cookie headers in API responses
  • For deployments behind TLS-terminating reverse proxies, confirm the proxy forwards the original protocol scheme or that Airflow configuration correctly identifies HTTPS termination
  • Review load balancer and proxy configurations to ensure X-Forwarded-Proto or equivalent headers are properly passed to the Airflow API server
  • Audit existing session JWTs and consider rotating them if compromise is suspected in environments matching the vulnerable topology
  • Monitor for unauthorized API access using captured session tokens as an indicator of potential exploitation

Evidence notes

CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) identified in NVD source metadata. Fix pull request and Apache security mailing list discussion referenced in official CVE record.

Official resources

2026-06-01