CVE-2026-82355
1 advisory.
PyPI/apache-airflow CVE-2026-82355: medium 4.2, EPSS 0.73%
When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.3.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-3989
- http://www.openwall.com/lists/oss-security/2026/09/21/4
- https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1
- https://github.com/apache/airflow/pull/72225
- https://github.com/apache/airflow/pull/72723
CVE-2026-82355 · published · modified · JSON