https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:21:45.928181+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-05229 bdu:2023-05229 2026-10-07T21:21:45.935250+00:00 bdu:2023-05229 https://cve.radiocsirt.org/vuln/bit-airflow-2023-40273 BIT-airflow-2023-40273 — Session fixation in Apache Airflow web interface 2026-10-07T21:21:45.935294+00:00

Affected: Bitnami: airflow

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).

With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.

Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.

 https://cve.radiocsirt.org/vuln/cnvd-2023-70279 cnvd-2023-70279 2026-10-07T21:21:45.935406+00:00 cnvd-2023-70279 https://cve.radiocsirt.org/vuln/euvd-2026-189882 EUVD-2026-189882 2026-10-07T21:21:45.935434+00:00 EUVD-2026-189882 https://cve.radiocsirt.org/vuln/fkie_cve-2023-40273 fkie_cve-2023-40273 2026-10-07T21:21:45.935456+00:00

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).

With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.

Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-pm87-24wq-r8w9 GHSA-pm87-24wq-r8w9 — Apache Airflow Session Fixation vulnerability 2026-10-07T21:21:45.935508+00:00

Affected: PyPI: apache-airflow

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).

With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.

Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2023-40273 gsd-2023-40273 2026-10-07T21:21:45.935538+00:00 gsd-2023-40273 https://cve.radiocsirt.org/vuln/pysec-2023-158 PYSEC-2023-158 2026-10-07T21:21:45.935550+00:00

Affected: PyPI: apache-airflow

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).

With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.

Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.