CVE-2026-40961: Apache Airflow Authenticated User URL Bypass Vulnerability
Summary
CVE-2026-40961: Apache Airflow: Authenticated users can bypass the is_safe_url check. Affects apache-airflow versions < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-40961 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and managing workflows in data engineering. The platform supports various integrations and is known for its flexibility and scalability. However, it has a vulnerability that allows authenticated users to bypass security checks, potentially leading to unauthorized access to sensitive resources.
Vulnerability Detail
A bug in the login redirect route of Apache Airflow allows authenticated users to craft URLs that circumvent the 'is_safe_url' check. This vulnerability can lead to redirection from a trusted Airflow domain to an attacker-controlled origin, posing a significant security risk. The flaw originates from improper validation of redirect URLs, which could be exploited to conduct phishing attacks or redirect users to malicious sites.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain 'next=' query parameters before they reach the login endpoint. This can be configured in the reverse proxy settings to enhance security.
Conclusion
CVE-2026-40961 is a significant vulnerability in Apache Airflow that allows authenticated users to bypass security checks, leading to potential redirection to malicious sites. Users are strongly advised to upgrade to version 3.2.2 or later to mitigate this risk. Implementing a reverse proxy can also serve as an effective workaround.
See every vulnerability recorded for apache-airflow →
FAQ
CVE-2026-40961 is a vulnerability in Apache Airflow that allows authenticated users to bypass the 'is_safe_url' check, potentially leading to redirection to malicious sites.
If you are using a version prior to 3.2.2, your installation is vulnerable to CVE-2026-40961. You can check your version by running 'apache-airflow version' in your terminal.
The vulnerability could lead to phishing attacks, unauthorized access to sensitive data, and exploitation of users through malicious redirects.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2026-40961 is 7.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
