CVE-2026-41017

Apache Airflow's JWTRefreshMiddleware set the JWT auth cookie without the Secure flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +264 more potentially affected by CVE-2026-41017 via apache-airflow (>=1.8.2, <=3.2.2rc3)

apache-airflow PYPI version =1.8.2, =0.8.44.4rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.2.1, =0.2.9b1, =1.0.7, =0.4.0, =0.1.0a1, =0.5.1, =1.6.0 and more Source cves: CVE-2026-41017 Source advisory: MEND:CVE-2026-41017...

CVE-2026-41017

Apache Airflow's JWTRefreshMiddleware set the JWT auth cookie without the Secure flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default...

CVE-2026-41017

creationtimestamp| type| source ---|---|--- 2026-05-31 12:38:39+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn5lhr4e5z23...