SB2026092130 - Multiple vulnerabilities in Apache Airflow

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092130

SB2026092130 - Multiple vulnerabilities in Apache Airflow

Published: September 21, 2026 Updated: September 22, 2026

Security Bulletin ID SB2026092130
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-75157)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to suppress asset-triggered scheduling.

The vulnerability exists due to improper authorization in the asset queued-events DELETE endpoints when handling DELETE requests. A remote user can delete queued asset events for Dags they can read to suppress asset-triggered scheduling.

The issue affects deployments where asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access.


2) Session Fixation (CVE-ID: CVE-2026-82355)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause principal confusion and misattribute audit records.

The vulnerability exists due to improper authentication in Airflow core API authentication handling when processing requests that include both a session cookie and an explicit Authorization bearer token. A remote user can place a valid session cookie in a victim's browser or client to cause principal confusion and misattribute audit records.

Deployments hosting the Airflow UI on a domain shared with other applications are the most exposed.


3) Insufficient Session Expiration (CVE-ID: CVE-2026-86473)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to retain access using a valid bearer token after logout.

The vulnerability exists due to improper session invalidation in the Core API logout endpoint when processing a logout request with a bearer token in the Authorization header. A remote user can present a copied valid bearer token after the victim logs out to retain access using a valid bearer token after logout.

The default token lifetime is 24 hours and is configurable.


4) Missing Authorization (CVE-ID: CVE-2026-75158)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose asset events belonging to unauthorized Dags.

The vulnerability exists due to missing authorization in the /assets/events API when handling asset event requests. A remote user can send requests to disclose asset events for Dags they are not authorized to read.

The count query and pagination metadata can reveal the existence of hidden Dags.


Remediation

Install update from vendor's website.

References