---
id: CVE-2026-40961
title: >-
  A bug in the login redirect route in Apache Airflow allowed authenticated
  users to craft URLs that bypassed the `is_safe_url` check, enabling
  redirection from a trusted Airflow domain to an attacker-controlled origin
summary: >-
  A bug in the login redirect route in Apache Airflow allowed authenticated
  users to craft URLs that bypassed the `is_safe_url` check, enabling
  redirection from a trusted Airflow domain to an attacker-controlled origin.
  Users are advised t…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: apache
product: airflow
affected:
  - 'airflow >= 3.0.0, < 3.2.2'
patched:
  - airflow 3.2.2
published: '2026-06-01'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T07:19:55.147'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40961'
references:
  - url: 'https://github.com/apache/airflow/pull/65557'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/05/31/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40961'
  - url: >-
      https://github.com/apache/airflow/commit/555f35576e3143dec65a7fb9acd95891841b45f2
  - url: >-
      https://github.com/apache/airflow/commit/bfd1881fa0cb1193f49dbac72d7462e66aaf8f25
  - url: 'https://github.com/apache/airflow'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2345.yaml
  - url: 'https://pypi.org/project/apache-airflow'
  - url: 'https://github.com/advisories/GHSA-6hcw-qqr8-pjj8'
tags:
  - nvd
  - cve.org
  - osv
  - pip
  - ghsa
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-02T16:26:18.324539Z'
epss: 0.00649
epssPercentile: 0.51223
aliases:
  - GHSA-6hcw-qqr8-pjj8
  - BIT-airflow-2026-40961
  - PYSEC-2026-2345
ecosystem: pip
ingestedAt: '2026-07-08T18:25:46.477Z'
---

## Overview

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain `next=` query parameters before they reach the login endpoint.

## Affected

- `airflow >= 3.0.0, < 3.2.2`

## Remediation

Upgrade past the affected range:

- `airflow 3.2.2`

## Package advisory (CVE-2026-40961)

Affected packages:

- `apache-airflow >= 3.0.0b3, < 3.2.2`

Patched in:

- `apache-airflow 3.2.2`

Source: https://osv.dev/vulnerability/GHSA-6hcw-qqr8-pjj8