CVE-2026-82355

Apache Airflow versions 3.3.0 and 3.3.1 are vulnerable to an Incorrect Authorization issue where the system prioritizes a session cookie over an explicit Authorization: Bearer token. This inversion of precedence allows an attacker who successfully plants a session cookie—via cookie tossing , cros...