Apache Airflow versions 3.1.0 through 3.1.7 set the session token cookie (_token) to path=’/’ regardless of the configured base_url. Key detail from the CVE description: this oversight allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, resulting in session hijacking. The vulnerability is classified as CWE-668 (Improper Limit on a Functionality). The impact is that an attacker who obtains a legitimate session token can perform actions on behalf of the authenticated user, potentially modifying workflows, accessing sensitive data, or escalating privileges.

Known affected vendor: Apache Software Foundation – Apache Airflow. Impacted releases are 3.1.0 through 3.1.7. No information is provided about older versions or higher major releases, nor for other vendors’ products.

CVSS score of 7.5 indicates high severity. EPSS score is listed as <1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack requires a co-hosted application on the same top-level domain, which is a reasonably achievable condition in shared hosting environments. An attacker can collect the cookie from incoming request headers and reuse the token to hijack an Airflow session.