{"id":"CVE-2026-40961","title":"A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin","summary":"A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised t…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-601"],"vendor":"apache","product":"airflow","affected":["airflow >= 3.0.0, < 3.2.2"],"patched":["airflow 3.2.2"],"published":"2026-06-01","updated":"2026-11-03","sourceUpdated":"2026-11-03T07:19:55.147","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40961","references":[{"url":"https://github.com/apache/airflow/pull/65557","label":"security@apache.org"},{"url":"https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/31/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40961"},{"url":"https://github.com/apache/airflow/commit/555f35576e3143dec65a7fb9acd95891841b45f2"},{"url":"https://github.com/apache/airflow/commit/bfd1881fa0cb1193f49dbac72d7462e66aaf8f25"},{"url":"https://github.com/apache/airflow"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2345.yaml"},{"url":"https://pypi.org/project/apache-airflow"},{"url":"https://github.com/advisories/GHSA-6hcw-qqr8-pjj8"}],"tags":["nvd","cve.org","osv","pip","ghsa"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-02T16:26:18.324539Z"},"epss":0.00649,"epssPercentile":0.51223,"aliases":["GHSA-6hcw-qqr8-pjj8","BIT-airflow-2026-40961","PYSEC-2026-2345"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:46.477Z","slug":"CVE-2026-40961","body":"## Overview\n\nA bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain `next=` query parameters before they reach the login endpoint.\n\n## Affected\n\n- `airflow >= 3.0.0, < 3.2.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `airflow 3.2.2`\n\n## Package advisory (CVE-2026-40961)\n\nAffected packages:\n\n- `apache-airflow >= 3.0.0b3, < 3.2.2`\n\nPatched in:\n\n- `apache-airflow 3.2.2`\n\nSource: https://osv.dev/vulnerability/GHSA-6hcw-qqr8-pjj8","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}