CVE-2026-40961: Apache Airflow Open Redirect Bypass Vulnerability
Summary
CVE-2026-40961: Apache Airflow: Open Redirect Bypass Vulnerability. Affects airflow versions >= 3.0.0, < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2026-40961 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and automating tasks. The platform allows users to define workflows as Directed Acyclic Graphs (DAGs) and provides a rich user interface for managing and visualizing these workflows. However, a recent vulnerability has been identified that affects the security of the login process, potentially exposing users to malicious redirection.
Vulnerability Detail
The vulnerability arises from a flaw in the login redirect route of Apache Airflow, which allows authenticated users to create URLs that bypass the 'is_safe_url' check. This flaw can lead to unauthorized redirection from a trusted Airflow domain to an attacker-controlled site, posing significant risks such as phishing attacks or data theft. The vulnerability is classified as high severity, with a CVSS score of 6.5, indicating that it could be exploited easily by an attacker with no prior privileges.
How To Fix
Minimum fixed version
3.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a defense-in-depth measure, deployment operators can implement a reverse proxy that strips off-domain 'next=' query parameters before they reach the login endpoint. This can be configured in the reverse proxy settings to enhance security against this vulnerability.
Conclusion
The CVE-2026-40961 vulnerability in Apache Airflow poses a significant risk due to its potential for enabling unauthorized redirection. Users are strongly advised to upgrade to version 3.2.2 or later to mitigate this risk. Implementing a reverse proxy can serve as an additional layer of security while the upgrade is being planned.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-40961 is a vulnerability in Apache Airflow that allows authenticated users to bypass security checks during the login process, potentially leading to malicious redirection.
If you are using Apache Airflow version 3.0.0 to 3.2.1, your installation is vulnerable. Upgrading to version 3.2.2 or later will resolve the issue.
The primary risk is that users could be redirected to malicious sites, which could lead to phishing attacks or unauthorized access to sensitive information.
Yes, deploying a reverse proxy that strips off-domain 'next=' query parameters can serve as a temporary workaround to mitigate the risk.
Detailed information can be found in the official Apache Airflow security advisories and on vulnerability databases such as the one maintained by Bitnami.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
