Apache Airflow Session Token Path Vulnerability Allowing Session Hijacking

A vulnerability exists in Apache Airflow versions 3.1.0 to 3.1.7, where the session token in cookies is set to the root path, regardless of the configured webserver or API base URLs. This misconfiguration allows any application co-hosted under the same domain to intercept valid Airflow session tokens from HTTP request headers, enabling full session takeover without directly attacking Airflow. Users are advised to upgrade to Apache Airflow 3.1.8 or later, which addresses this issue.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can take over a user's session in Airflow by capturing the session token from cookies.

Remediation

Users should upgrade to Apache Airflow version 3.1.8 or later.