Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g8pv-cam5-d7dj
Vulnerability ID VCID-g8pv-cam5-d7dj
Aliases BIT-airflow-2026-28779
CVE-2026-28779
GHSA-4fhm-p86v-hwpx
PYSEC-2026-16
Summary Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-668 Exposure of Resource to Wrong Sphere
System Score Found at
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-28779
cvssv3.1 7.5 https://github.com/apache/airflow
generic_textual HIGH https://github.com/apache/airflow
cvssv3.1 7.5 https://github.com/apache/airflow/pull/62771
generic_textual HIGH https://github.com/apache/airflow/pull/62771
ssvc Track https://github.com/apache/airflow/pull/62771
cvssv3.1 7.5 https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
generic_textual HIGH https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
ssvc Track https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-28779
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-28779
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2026/03/17/3
generic_textual HIGH http://www.openwall.com/lists/oss-security/2026/03/17/3
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-28779
https://github.com/apache/airflow
https://github.com/apache/airflow/pull/62771
https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
https://nvd.nist.gov/vuln/detail/CVE-2026-28779
http://www.openwall.com/lists/oss-security/2026/03/17/3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/airflow/pull/62771
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-17T13:44:27Z/ Found at https://github.com/apache/airflow/pull/62771
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-17T13:44:27Z/ Found at https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-28779
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2026/03/17/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09334
EPSS Score 0.00031
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:37:39.395327+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2026-16.yaml 38.6.0