{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.3.0"}],"component":"apache-airflow","cve_ids":["CVE-2026-82355"],"ecosystem":"PyPI","epss":0.00735,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KH93SM79954W4WV0S3Q2WV","modified_at":"2026-09-26T09:25:59.744943687Z","published_at":"2026-09-21T15:17:32.430Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3989","http://www.openwall.com/lists/oss-security/2026/09/21/4","https://lists.apache.org/thread/3p7zpdvv40tn01m0xk5mt2rxg88mw8w1","https://github.com/apache/airflow/pull/72225","https://github.com/apache/airflow/pull/72723"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"PYSEC-2026-3989","url":"https://osv.dev/vulnerability/PYSEC-2026-3989"}],"summary":"When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting"}