---
id: CVE-2026-28779
title: "Apache Airflow versions 3.1.0 through 3.1.7\_session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\nThis allows any application co-hosted under the same domain to capture va…"
summary: "Apache Airflow versions 3.1.0 through 3.1.7\_session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.\nThis allows any application co-hosted under the same domain to capture va…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-668
vendor: apache
product: airflow
affected:
  - 'airflow >= 3.0.0, < 3.1.8'
patched:
  - airflow 3.1.8
published: '2026-03-17'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T07:18:57.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28779'
references:
  - url: 'https://github.com/apache/airflow/pull/62771'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/r4n5znb8mcq14wo9v8ndml36nxlksdqb'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/03/17/3'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-17T13:44:27.820701Z'
epss: 0.00704
epssPercentile: 0.53481
ingestedAt: '2026-11-05T06:38:03.607Z'
---

## Overview

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

## Affected

- `airflow >= 3.0.0, < 3.1.8`

## Remediation

Upgrade past the affected range:

- `airflow 3.1.8`