Apache Airflow versions 3

The bug is not in authentication itself; it is in *where the browser sends the Airflow session cookie*. For affected Apache Airflow releases, the _token cookie is scoped to / instead of the configured base_url, so any sibling application under the same parent domain can receive it in request headers. The public records are slightly inconsistent on version bounds: the narrative description says 3.1.0 through 3.1.7, while the NVD/GitHub advisory affected-range metadata says >=3.0.0, <3.1.8; either way, 3.1.8 is the fixed release.

The vendor's *HIGH 7.5* score overrates real enterprise risk. Raw CVSS treats this like a clean unauthenticated network confidentiality issue, but the actual attack path needs a very specific topology: Airflow must share a parent domain with another app the attacker controls or has already compromised, and users must browse both. That is real and worth fixing, but it is not the same thing as an internet-drive-by Airflow takeover.

Why this verdict

• Downgraded for attacker position: the attacker usually needs control of a sibling app on the same domain, which implies prior compromise, risky multi-tenant hosting, or an internal/shared platform design.
• Downgraded for exposed population: only Airflow deployments sharing a parent domain with other reachable apps are meaningfully exposed; dedicated hostnames make the bug mostly irrelevant.
• Kept at MEDIUM for impact: if the prerequisite is met, the attacker can steal a live Airflow session and inherit the victim's privileges with no need to attack Airflow directly.
• Downgraded for threat intel: EPSS is extremely low, there is no KEV entry, and the reviewed sources do not describe active campaigns.
• Notably, even the disclosure mail says Severity: Medium: that lines up better with real operator risk than the 7.5 CVSS label.

Why not higher?

This is not a straightforward unauthenticated remote compromise of Airflow. The exploit chain depends on same-domain co-hosting and a second app the attacker can run or compromise, which dramatically cuts both the exposed population and the likelihood of internet-scale abuse. There is also no public exploitation evidence pushing this into emergency territory.

Why not lower?

Once the prerequisite exists, the impact is not cosmetic; it is full Airflow session hijack. In organizations where platform teams multiplex admin apps behind one shared ingress, this can become a meaningful lateral-movement shortcut, especially against privileged Airflow users.

1. Move Airflow to a dedicated hostname — Stop sharing the parent domain with unrelated applications so the browser never has a sibling app to send the Airflow cookie to. For a MEDIUM verdict there is no mitigation SLA, but this is the cleanest architectural fix to schedule before or alongside the upgrade and complete within the 365-day remediation window.
2. Eliminate path-based multi-app co-hosting for admin tools — If Airflow is mounted at /team-a, /airflow, or similar behind a shared reverse proxy, split it onto its own DNS name or trust boundary. There is no mitigation SLA for MEDIUM, so do this in the next normal change cycle rather than as an emergency block.
3. Reduce session lifetime and invalidate old sessions after upgrade — Short-lived sessions reduce the usable window for stolen _token values, and forced re-authentication burns any previously harvested cookies after you patch. For MEDIUM, handle this during standard ops change management and finish actual remediation within 365 days.
4. Review sibling-app logging for inbound cookies — Check same-domain app and reverse-proxy logs for unexpected Airflow _token cookies landing outside Airflow paths. This is detection-heavy rather than preventive, and for MEDIUM it belongs in the next routine detection engineering sprint.

Run this on the Airflow host, container, or image build pipeline where apache-airflow is installed. Invoke it as python3 check_cve_2026_28779.py /etc/airflow/airflow.cfg; no admin rights are required unless the config file is root-readable only. The script checks the installed Airflow version and the configured AIRFLOW__WEBSERVER__BASE_URL / AIRFLOW__API__BASE_URL or values from airflow.cfg, then prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2026_28779.py
# Detect likely exposure to CVE-2026-28779 on an Airflow node/container.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import configparser
import os
import sys
from urllib.parse import urlparse

try:
    from importlib import metadata as importlib_metadata
except Exception:
    import importlib_metadata  # type: ignore


def parse_version(v):
    parts = []
    for token in str(v).split('.'):
        num = ''
        for ch in token:
            if ch.isdigit():
                num += ch
            else:
                break
        parts.append(int(num) if num else 0)
    while len(parts) < 3:
        parts.append(0)
    return tuple(parts[:3])


def version_in_range(v, low_incl, high_excl):
    return parse_version(low_incl) <= parse_version(v) < parse_version(high_excl)


def get_installed_version():
    candidates = ['apache-airflow', 'apache_airflow']
    for name in candidates:
        try:
            return importlib_metadata.version(name)
        except Exception:
            continue
    return None


def read_cfg(path):
    data = {}
    if not path or not os.path.isfile(path):
        return data
    cp = configparser.ConfigParser()
    try:
        cp.read(path)
    except Exception:
        return data
    if cp.has_section('webserver') and cp.has_option('webserver', 'base_url'):
        data['webserver_base_url'] = cp.get('webserver', 'base_url').strip()
    if cp.has_section('api') and cp.has_option('api', 'base_url'):
        data['api_base_url'] = cp.get('api', 'base_url').strip()
    return data


def path_from_url(value):
    if not value:
        return None
    try:
        parsed = urlparse(value)
        path = parsed.path or '/'
        return path
    except Exception:
        return None


def non_root_path(value):
    p = path_from_url(value)
    if p is None:
        return False
    return p not in ('', '/')


def main():
    cfg_path = sys.argv[1] if len(sys.argv) > 1 else os.environ.get('AIRFLOW_CONFIG') or '/etc/airflow/airflow.cfg'
    version = get_installed_version()
    if not version:
        print('UNKNOWN - apache-airflow package version not found')
        sys.exit(2)

    cfg = read_cfg(cfg_path)
    web_base = os.environ.get('AIRFLOW__WEBSERVER__BASE_URL') or cfg.get('webserver_base_url')
    api_base = os.environ.get('AIRFLOW__API__BASE_URL') or cfg.get('api_base_url')

    affected = version_in_range(version, '3.0.0', '3.1.8')
    fixed = parse_version(version) >= parse_version('3.1.8')

    if fixed:
        print(f'PATCHED - apache-airflow {version} >= 3.1.8')
        sys.exit(0)

    if not affected:
        print(f'UNKNOWN - apache-airflow {version} is outside the published affected range used by this check')
        sys.exit(2)

    # Practical exposure check: bug matters when Airflow is intended to live under a subpath.
    web_non_root = non_root_path(web_base)
    api_non_root = non_root_path(api_base)

    if web_non_root or api_non_root:
        details = []
        if web_non_root:
            details.append(f'webserver.base_url={web_base}')
        if api_non_root:
            details.append(f'api.base_url={api_base}')
        print('VULNERABLE - apache-airflow {} with non-root base URL(s): {}'.format(version, ', '.join(details)))
        sys.exit(1)

    if web_base or api_base:
        print('UNKNOWN - apache-airflow {} is in affected versions, but configured base URLs appear root-scoped; validate shared-domain co-hosting manually'.format(version))
        sys.exit(2)

    print('UNKNOWN - apache-airflow {} is in affected versions, but base_url settings were not found; inspect AIRFLOW__WEBSERVER__BASE_URL, AIRFLOW__API__BASE_URL, and reverse-proxy topology manually'.format(version))
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE record
2. GitHub Advisory GHSA-4fhm-p86v-hwpx
3. Apache Airflow fix PR #62771
4. Apache Airflow releases
5. Openwall disclosure mail
6. Airflow configuration reference
7. CISA Known Exploited Vulnerabilities catalog