CVE-2026-41017

Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session JWT replayed over any cleartext HTTP request to the same host. A network-positioned attacker (Wi-Fi MITM, hostile LAN, captive-portal proxy) could induce a logged-in user's browser to issue an HTTP request to the deployment's hostname and capture the JWT cookie out of that request, then replay it against the authenticated API. Affects deployments where the Airflow API server is reached through a TLS-terminating proxy and the cookie's secure-by-default protection is load-bearing for session integrity. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

• CWE-614

• https://github.com/apache/airflow/pull/65348Issue Tracking, Patch
• https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdchMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/6Mailing List, Third Party Advisory

Published

Jun 1, 2026

Last Modified

Jul 21, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41010ReleaseJob#unpack builds job_dir = File.join(@release_dir, '…8.7
• CVE-2026-41011PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" w…8.7
• CVE-2026-41013Input validation bypass in SMB volume mount handling in Clou…8.1
• CVE-2026-41014The partitioned_dag_runs endpoints in the Airflow UI enforce…4.3
• CVE-2026-41015radare2 before 9236f44, when configured on UNIX without SSL,…7.4
• CVE-2026-41016Apache Airflow's SMTP provider `SmtpHook` called Python's `s…5.9
• CVE-2026-41018The Elasticsearch logging provider, when configured with a `…6.5
• CVE-2026-41030In ONLYOFFICE DesktopEditors before 9.3.0, the update servic…6.2
• CVE-2026-41031A Stored Cross-Site Scripting vulnerability in Vinna Process…9.3
• CVE-2026-41032It is possible for an unauthenticated adjacent attacker to d…7.5
• CVE-2026-41034ONLYOFFICE DocumentServer before 9.3.0 has an untrusted poin…5
• CVE-2026-41035In rsync 3.0.1 through 3.4.1, receive_xattr relies on an unt…7.8