CVE-2026-41017: Apache Airflow Sensitive Cookie Vulnerability in HTTPS Session
Summary
CVE-2026-41017: Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. Affects apache-airflow versions >= 3.0.0, < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2026-41017 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and automating tasks. The platform supports various integrations and provides a web interface for managing workflows. However, a recent vulnerability has been identified that affects the security of user sessions when deployed behind HTTPS-terminating proxies.
Vulnerability Detail
The vulnerability arises from the JWTRefreshMiddleware in Apache Airflow, which sets the JWT authentication cookie without the 'Secure' flag. This omission allows the cookie to be transmitted over unencrypted HTTP connections, making it susceptible to interception by network-positioned attackers, such as those on a Wi-Fi network or hostile LAN. If an attacker captures the JWT cookie, they can replay it to gain unauthorized access to the API, compromising user sessions and potentially sensitive data.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==3.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can configure their deployment to ensure that all communications are conducted over HTTPS and avoid using HTTP. However, this does not fully mitigate the risk associated with the missing 'Secure' flag on the cookie.
Conclusion
The vulnerability identified in Apache Airflow regarding the JWT cookie's lack of the 'Secure' attribute poses a significant risk to user session integrity. Users are strongly advised to upgrade to version 3.2.2 or later to mitigate this risk effectively. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for apache-airflow →
FAQ
The vulnerability involves the absence of the 'Secure' attribute on the JWT authentication cookie, allowing it to be sent over unencrypted HTTP connections.
Deployments of Apache Airflow that are accessed through an HTTPS-terminating proxy and rely on the cookie's secure protection are affected.
An attacker could intercept the JWT cookie and use it to impersonate a logged-in user, gaining unauthorized access to the API and sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
