CVE-2026-41017

MEDIUM EPSS 17.8%

Published Jun 1, 20261mo ago · Modified Jun 17, 20262w ago

5.9 CVSS 3.1

Medium

Published Jun 1, 2026 1mo ago

Last Modified Jun 17, 2026 2w ago

Description

Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session JWT replayed over any cleartext HTTP request to the same host. A network-positioned attacker (Wi-Fi MITM, hostile LAN, captive-portal proxy) could induce a logged-in user's browser to issue an HTTP request to the deployment's hostname and capture the JWT cookie out of that request, then replay it against the authenticated API. Affects deployments where the Airflow API server is reached through a TLS-terminating proxy and the cookie's secure-by-default protection is load-bearing for session integrity. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

CVSS Details

Base Score

5.9

Exploitability

2.2

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

17.8% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-614

Affected Products 1

Vendor	Product	Version	Range
apache	airflow	*	≥3.0.0 – <3.2.2

References 3

openwall.com http://www.openwall.com/lists/oss-security/2026/05/31/6

Mailing ListThird Party Advisory
github.com https://github.com/apache/airflow/pull/65348

Issue TrackingPatch
lists.apache.org https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch

Mailing ListVendor Advisory

Remediation

github.com https://github.com/apache/airflow/pull/65348

Issue TrackingPatch