CVE-2026-41017: Apache Airflow JWT Cookie Lacks Secure Flag in JWTRefreshMiddleware
Summary
CVE-2026-41017: Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy. Affects airflow versions >= 3.0.0, < 3.2.2. Fixed in 3.2.2. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2026-41017 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. It is widely used for orchestrating complex data pipelines and automating tasks. The platform's architecture allows for integration with various data sources and services, making it a popular choice among data engineers and analysts. However, the security of the Airflow API can be compromised if proper measures are not in place, particularly regarding session management and cookie security.
Vulnerability Detail
The vulnerability arises from the JWTRefreshMiddleware in Apache Airflow, which sets the JWT authentication cookie without the Secure flag. This oversight is particularly critical for deployments behind HTTPS-terminating proxies, such as nginx or managed load balancers. When the Secure flag is absent, the JWT cookie can be transmitted over unencrypted HTTP requests, making it susceptible to interception by attackers positioned on the same network. This could lead to session hijacking, where an attacker captures the JWT and uses it to impersonate a legitimate user, gaining unauthorized access to the API.
How To Fix
Minimum fixed version
3.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading is not immediately feasible, consider implementing additional security measures such as enforcing HTTPS across all endpoints and ensuring that the application is not accessible over HTTP. This can help mitigate the risk of cookie interception until the upgrade can be performed.
Conclusion
CVE-2026-41017 highlights a critical security oversight in Apache Airflow's JWT cookie management, particularly for deployments behind HTTPS-terminating proxies. Users are strongly advised to upgrade to version 3.2.2 or later to mitigate the risk of session hijacking. Implementing additional security measures can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for airflow →
FAQ
CVE-2026-41017 is a vulnerability in Apache Airflow that allows JWT cookies to be transmitted without the Secure flag, making them susceptible to interception over unencrypted connections.
If your Airflow API server is behind an HTTPS-terminating proxy and the Secure flag is not set on the JWT cookie, attackers could capture and replay the JWT, potentially gaining unauthorized access to your API.
As a temporary measure, ensure that your Airflow instance is only accessible over HTTPS and consider implementing additional security controls to protect against session hijacking.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability could lead to unauthorized access to your Airflow API, allowing attackers to manipulate workflows, access sensitive data, or disrupt operations.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
