CVE-2023-40273: Session Fixation Vulnerability in Apache Airflow
Summary
CVE-2023-40273: The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Affects apache-airflow versions < 2.7.1rc1. Fixed in 2.7.1rc1. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2023-40273 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling complex workflows. It provides a web-based interface for managing and monitoring workflows. The vulnerability in Apache Airflow allows an authenticated user to continue accessing the Airflow webserver even after their password has been reset by the admin. This vulnerability affects versions prior to 2.7.0.
Vulnerability Detail
The session fixation vulnerability in Apache Airflow allows an authenticated user to maintain access to the webserver even after their password has been reset. This is possible until the user's session expires. The vulnerability can be exploited by an attacker who gains access to a user's session and fixes it to their own session. This allows the attacker to continue accessing the webserver with the user's privileges. The impact of this vulnerability is that an attacker can impersonate a legitimate user and perform unauthorized actions on the Airflow webserver.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1rc1
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.7.1rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. However, for users using the securecookie session backend, changing the secure key and restarting the webserver can help invalidate all sessions. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability.
Conclusion
The session fixation vulnerability in Apache Airflow allows an authenticated user to maintain access to the webserver even after their password has been reset. To mitigate this vulnerability, it is recommended to upgrade to version 2.7.0 or newer and follow the steps mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
The impact of this vulnerability is that an attacker can impersonate a legitimate user and perform unauthorized actions on the Airflow webserver.
To fix this vulnerability, users of Apache Airflow should upgrade to version 2.7.0 or newer. Additionally, for users using the securecookie session backend, changing the secure key and restarting the webserver is recommended.
There are no specific workarounds mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the vulnerability.
Yes, the documentation for Apache Airflow has been updated to explain the behavior and steps to mitigate this vulnerability.
Versions of Apache Airflow prior to 2.7.0 are affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
