Apache Airflow: Authenticated users can bypass the `is_safe_url` check
GHSA-6hcw-qqr8-pjj8 · BIT-airflow-2026-40961 · CVE-2026-40961 · PYSEC-2026-2345
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the is_safe_url check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain next= query parameters before they reach the login endpoint.
Ready to move
Start Securing
Free, no credit card | First findings in minutes