CVE-2023-40273

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that). With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour. Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.

• CWE-384

• https://github.com/apache/airflow/pull/33347Third Party Advisory
• https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80njVendor Advisory
• https://www.openwall.com/lists/oss-security/2023/08/23/1Mailing List, Third Party Advisory
• https://github.com/apache/airflow/pull/33347Third Party Advisory
• https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80njVendor Advisory
• https://www.openwall.com/lists/oss-security/2023/08/23/1Mailing List, Third Party Advisory

Published

Aug 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40266An issue was discovered in Atos Unify OpenScape Xpressions W…9.8
• CVE-2023-40267GitPython before 3.1.32 does not block insecure non-multi op…9.8
• CVE-2023-4027The Radio Player plugin for WordPress is vulnerable to unaut…5.3
• CVE-2023-40270Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-40271In Trusted Firmware-M through TF-Mv1.8.0, for platforms that…7.5
• CVE-2023-40272Apache Airflow Spark Provider, versions before 4.1.3, is aff…7.5
• CVE-2023-40274An issue was discovered in zola 0.13.0 through 0.17.2. The c…7.5
• CVE-2023-40275An issue was discovered in OpenClinic GA 5.247.01. It allows…9.1
• CVE-2023-40276An issue was discovered in OpenClinic GA 5.247.01. An Unauth…9.1
• CVE-2023-40277An issue was discovered in OpenClinic GA 5.247.01. A Reflect…6.1
• CVE-2023-40278An issue was discovered in OpenClinic GA 5.247.01. An Inform…7.5
• CVE-2023-40279An issue was discovered in OpenClinic GA 5.247.01. An attack…7.5