Vulnerability GHSA-6hcw-qqr8-pjj8
High Risk
HIGH RISK
CVSS Score: 7.2
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 months ago
June 01, 2026 at 09:31 AM UTC
Apache Airflow: Authenticated users can bypass the `is_safe_url` check
3.0.0b4 - 3.2.2rc3
3.0.0b4 - 3.2.2rc3
Summary
Apache Airflow: Authenticated users can bypass the `is_safe_url` check
Details
A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the is_safe_url check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain next= query parameters before they reach the login endpoint.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
1 month ago
No summary available
1.8.1 - 3.3.0 and 3.3.1 PYSEC-2026-3989
1.8.1 - 3.3.0 and 3.3.1 PYSEC-2026-3989
Critical
1 month ago
No summary available
3.0.0 - 3.3.2rc1 PYSEC-2026-3990
3.0.0 - 3.3.2rc1 PYSEC-2026-3990
Medium Risk
1 month ago
No summary available
1.8.1 - 3.3.2rc1 PYSEC-2026-3988
1.8.1 - 3.3.2rc1 PYSEC-2026-3988
Medium Risk
1 month ago
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API
1.8.1 - 3.3.0rc2 PYSEC-2026-3806
1.8.1 - 3.3.0rc2 PYSEC-2026-3806
Medium Risk
2 months ago
Apache Airflow missing team context permits cross-team Dag actions and XCom reads
1.8.1 - 3.3.1rc2 GHSA-5247-m8w9-2v4m
1.8.1 - 3.3.1rc2 GHSA-5247-m8w9-2v4m
Impacted packages
Timeline
Published
5 months ago
June 01, 2026 at 09:31 AM UTC
Fixed (3.2.2)
5 months ago
May 29, 2026 at 05:20 AM UTC
Last Modified
7 hours ago
November 02, 2026 at 11:15 PM UTC