https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:12:50.272784+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05613 bdu:2026-05613 2026-10-03T03:12:50.377227+00:00 bdu:2026-05613 https://cve.radiocsirt.org/vuln/bit-airflow-2026-28779 BIT-airflow-2026-28779 — Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applicatio… 2026-10-03T03:12:50.377273+00:00

Affected: Bitnami: airflow

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-hu66748 CLEANSTART-2026-HU66748 — Security fix for CVE-2026-28779 applied in: airflow-3 3.1.8-r5 2026-10-03T03:12:50.377329+00:00

Affected: CleanStart: airflow-3

Security vulnerability affects the airflow-3 package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/cnvd-2026-15156 cnvd-2026-15156 2026-10-03T03:12:50.377363+00:00 cnvd-2026-15156 https://cve.radiocsirt.org/vuln/euvd-2026-276343 EUVD-2026-276343 2026-10-03T03:12:50.377383+00:00 EUVD-2026-276343 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28779 fkie_cve-2026-28779 2026-10-03T03:12:50.377401+00:00

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

 https://cve.radiocsirt.org/vuln/ghsa-4fhm-p86v-hwpx GHSA-4fhm-p86v-hwpx — Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applicatio… 2026-10-03T03:12:50.377442+00:00

Affected: PyPI: apache-airflow

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-16 PYSEC-2026-16 2026-10-03T03:12:50.377482+00:00

Affected: PyPI: apache-airflow

Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url. This allows any application co-hosted under the same domain to capture valid Airflow session tokens from HTTP request headers, allowing full session takeover without attacking Airflow itself.

Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0755 WID-SEC-W-2026-0755 — Apache Airflow: Mehrere Schwachstellen 2026-10-03T03:12:50.377518+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.