GHSA-6hcw-qqr8-pjj8HighCVSS 7.2
Apache Airflow: Authenticated users can bypass the `is_safe_url` check
🔗 CVE IDs covered (1)
📋 Description
A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the is_safe_url check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain next= query parameters before they reach the login endpoint.
🎯 Affected products1
- pip/apache-airflow:>= 3.0.0b3, < 3.2.2
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2026-40961
- https://github.com/apache/airflow/pull/65557
- https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q
- http://www.openwall.com/lists/oss-security/2026/05/31/2
- https://github.com/apache/airflow/commit/555f35576e3143dec65a7fb9acd95891841b45f2
- https://github.com/apache/airflow/commit/bfd1881fa0cb1193f49dbac72d7462e66aaf8f25
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-2345.yaml
- https://pypi.org/project/apache-airflow
- https://github.com/advisories/GHSA-6hcw-qqr8-pjj8