Apache Airflow versions 3.3.0 and 3.3.1 contain a logic flaw that accepts both a session cookie and an Authorization: Bearer token but resolves the caller from the cookie and ignores the bearer header. This inverted precedence causes the request to be executed and recorded as the cookie’s user instead of the bearer token’s user, enabling session fixation and producing misattributed audit records.

Only Apache Airflow 3.3.0 and 3.3.1 are affected; earlier releases do not contain the vulnerable code path and are not vulnerable. Deployments that host the Airflow UI on a domain shared with other applications are especially exposed because an attacker can place a valid session cookie into the victim’s browser via subdomain cookie tossing, cross‑site scripting in a co‑hosted app, or a shared workstation.

The vulnerability does not grant direct privilege escalation, but it allows an attacker to impersonate another user and corrupt audit trails. The CVSS score for this issue is 4.2. Exploitation requires obtaining a valid session cookie first, making it a medium‑likelihood attack that is more feasible in shared or poorly segregated environments. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog; no public exploits are reported at this time.