Live › vulnerability › CVE-2026-40961
Apache Airflow's login redirect route let an authenticated user craft a URL that skipped the is_safe_url check, so Airflow would redirect from its own domain to an attacker-chosen site. The sources describe an open redirect (CWE-601), not code execution or data theft.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 23:09 UTC, 0h before NVD. All times on this page are UTC.
Teams running self-hosted Apache Airflow 3.x between 3.0.0b3 and 3.2.1 are affected. The flaw needs an authenticated user, so deployments where only trusted staff can log in carry less risk, but any account holder can use it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow | pypi | >= 3.0.0b3, < 3.2.2 | 3.2.2 |
| apache airflow | vendor | >= 3.0.0, < 3.2.2 | 3.2.2 |
pip show apache-airflow and compare it to the affected range.>= 3.0.0b3 and < 3.2.2.apache-airflow 3.2.2 or later.next= query parameters before they reach the login endpoint.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the is_safe_url check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain next= query parameters before they reach the login endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-40961")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.