Apache Airflow: Authenticated users can bypass the `is_safe_url` check
GHSA-6hcw-qqr8-pjj8 · BIT-airflow-2026-40961 · CVE-2026-40961 · PYSEC-2026-2345
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the is_safe_url check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain next= query parameters before they reach the login endpoint.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-40961
- WEB https://github.com/apache/airflow/pull/65557
- WEB https://github.com/apache/airflow/commit/555f35576e3143dec65a7fb9acd95891841b45f2
- WEB https://github.com/apache/airflow/commit/bfd1881fa0cb1193f49dbac72d7462e66aaf8f25
- PACKAGE https://github.com/apache/airflow
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2345.yaml
- WEB https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q
- WEB https://pypi.org/project/apache-airflow
- WEB http://www.openwall.com/lists/oss-security/2026/05/31/2
Ready to move
Start Securing
Free, no credit card | First findings in minutes