CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Reported by oss-security

Summary by Cyber Security News21 Sep 2026, 19:14 CEST

About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/850

Posted by Rahul Vats on Sep 21 Severity: low Affected versions: - Apache Airflow 3.3.0 before 3.3.2 Description: When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

MongoDB Security Advisory (AV26-945)

CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

Exim security advisory (AV26-944)