CVE-2026-40961

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain `next=` query parameters before they reach the login endpoint.

• CWE-601

• https://github.com/apache/airflow/pull/65557Issue Tracking, Patch
• https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1qMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/2Mailing List, Third Party Advisory

Published

Jun 1, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40956CVE-2026-40956 is a memory disclosure vulnerability in Secur…3.7
• CVE-2026-40957o   CVE-2026-40957 is a frameable content vulnerability in t…7.5
• CVE-2026-40958CVE-2026-40958 is a input validation error in Secure Access …3.7
• CVE-2026-40959Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sa…9.3
• CVE-2026-4096IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP he…6.1
• CVE-2026-40960Luanti 5 before 5.15.2 sometimes allows unintended access to…8.1
• CVE-2026-40962FFmpeg before 8.1 has an integer overflow and resultant out-…9.8
• CVE-2026-40963The structure_data endpoint in the Airflow UI returned exter…3.1
• CVE-2026-40964Authentication Bypass in cf-auth-proxy in Cloud Foundry Foun…7.5
• CVE-2026-40965Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vul…10
• CVE-2026-40966In Spring AI, an attacker can bypass conversation isolation …5.9
• CVE-2026-40967In Spring AI, various FilterExpressionConverter implementati…8.6