Apache Airflow’s JWTRefreshMiddleware does not set the Secure flag on the authentication cookie. When the API server is accessed through an HTTPS‑terminating proxy, the cookie can be transmitted over cleartext HTTP. A network‑positioned attacker who can force a user’s browser to make an HTTP request to the same host can capture the cookie and reuse it to authenticate to Airflow, effectively hijacking the user’s session. This flaw corresponds to CWE‑614 (Insecure Direct Object Reference).

The vulnerability applies to any installation of Apache Airflow running Airflow API behind a TLS‑terminating reverse proxy (such as nginx, Envoy, or a cloud load balancer) that forwards unencrypted traffic to the Airflow server. All Airflow versions prior to 3.2.2 are impacted; users are advised to upgrade to 3.2.2 or later.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation at this time. However, because the attack requires a network adversary capable of inducing a user’s browser to make an HTTP request to the same host, the condition is hard to satisfy in controlled environments but plausible in compromised or captive‑portal networks. Once the cookie is captured, the attacker can reuse it until it expires or is refreshed, granting unauthorized API access. The CVSS score is 5.9.