6 matches found
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in JWTRefreshMiddleware's caller resolution, which resolves the caller from the session cookie and ignores an accompanying Authorization: Bearer token, inverting the intended precedence of bearer over cookie. An...
CVE-2026-82355
When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...
PYSEC-2026-3989
When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...
CVE-2026-82355
Apache Airflow versions 3.3.0 and 3.3.1 are vulnerable to an Incorrect Authorization issue where the system prioritizes a session cookie over an explicit Authorization: Bearer token. This inversion of precedence allows an attacker who successfully plants a session cookie—via cookie tossing , cros...
CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...
CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...