{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow-core","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.3.2","status":"affected","version":"3.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-82355","cwes":["CWE-384"],"description":"When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the identity the client explicitly presented.\n\nOnly Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier releases do not contain the code path that caches the cookie-derived user, and are not vulnerable.\n\nExploiting this requires an attacker to first place a valid session cookie of their own into the victim's browser or client: for example by cookie tossing from a sibling subdomain, through cross-site scripting in a separate application sharing a parent domain, or via a shared workstation. Deployments that host the Airflow UI on a domain shared with other applications are therefore the most exposed; a deployment on a dedicated domain with no co-hosted applications is not reachable this way. The consequence is principal confusion and misattributed audit records rather than a direct privilege escalation.\n\nUsers of 3.3.0 or 3.3.1 should upgrade to Apache Airflow 3.3.2 or later, which resolves the caller from the explicitly supplied credential whenever one is present.","epss":{"date":"2026-11-02","percentile":0.54443,"score":0.00735},"exploits":[],"kev":null,"metrics":[{"score":4.2,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793689247198,"publishedAt":1790001124932,"references":[{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/72225"},{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/72723"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/09/21/4"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/72225"},{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/72723"}],"revision":"ab3620e6fbbad80e54f273f31251af328b0240e0ce740781dbe46d25f48cf322","sources":[{"modifiedAt":1793689247198,"name":"CNA: apache","retrievedAt":1793693363066,"url":"https://www.cve.org/CVERecord?id=CVE-2026-82355"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793693364772,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82355"}],"ssvc":{"assessedAt":1790004228747,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation","updatedAt":1793693364772}