CVE-2026-82355

Executive Summary

CVE-2026-82355 is an authentication precedence flaw in Apache Airflow 3.3.0 and 3.3.1 where the core API resolves the caller identity from a session cookie even when an explicit Authorization: Bearer token is present, inverting the intended bearer-over-cookie precedence. Only deployments running Airflow 3.3.0 or 3.3.1 with the UI hosted on a shared parent domain (or otherwise exposed to cookie injection) are reachable. The impact is principal confusion and misattributed audit records rather than direct privilege escalation, reflected in a CVSS base score of 4.2.

Technical Analysis

Apache Airflow's core API supports two simultaneous authentication mechanisms: session cookies (used by the web UI) and Authorization: Bearer tokens (used by API clients and automation). Correctly implemented credential resolution should treat an explicitly presented bearer token as the authoritative identity assertion for a given request. In Airflow 3.3.0 and 3.3.1, a caching code path introduced for the cookie-derived user causes the API to resolve the caller from the cookie first and then ignore the bearer token entirely.

The core defect is a classic session fixation / credential precedence inversion, classified under CWE-384 (Session Fixation). The vulnerability is not that either credential is individually weak; it is that the two credentials disagree and the framework silently picks the lower-priority one. When a request carries both a session cookie and a bearer token, the request executes as the principal bound to the cookie, while the client believes it is operating as the identity asserted by the bearer token. Because authorization decisions are made against the resolved principal, the effective permissions for that request are those of the cookie holder, not the token holder.

Two secondary effects compound the issue:

1. Audit log misattribution. Airflow records the acting principal in its audit log. Because the request is attributed to the cookie's principal, any action taken while both credentials are present is logged against the wrong identity. This degrades forensic integrity: an investigator reviewing the audit trail will see actions attributed to a principal that may not have initiated them.
2. Silent divergence between intent and execution. A legitimate client that sends a bearer token alongside a stale or injected session cookie may have its request processed under the cookie's identity without any error, warning, or rejection. There is no graceful failure — the mismatch is invisible to both the caller and the server's normal logging.

The affected code path is specifically the cookie-derived user cache that was added in the 3.3.x line. Apache notes that earlier releases do not contain this caching path and are therefore not vulnerable, which scopes the issue precisely to 3.3.0 and 3.3.1. Airflow 3.3.2 restores correct precedence: whenever an explicit credential is supplied, the caller is resolved from that credential.

The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) describes the flaw accurately: network-reachable, high attack complexity due to the precondition of injecting a valid cookie into the victim's client, no privileges required, and user interaction required. Confidentiality and integrity impact are both Low, availability impact is None, and the scope remains unchanged.

Exploitation preconditions are the key constraint. The attacker must first place a valid session cookie of their own into the victim's browser or client. This is not achievable against a deployment hosted on a dedicated domain with no co-hosted applications. It becomes achievable when Airflow's UI shares a parent domain with other applications, enabling cookie tossing from a sibling subdomain, cross-site scripting in a separate co-hosted application, or simple credential reuse on a shared workstation.

Exploitation Scenarios

No public PoC is available for CVE-2026-82355; the attack chain below is inferred from the vulnerability class and the NVD description. Only technical elements explicitly described in the NVD text are used.

1) Reconnaissance / target identification. The attacker identifies an Apache Airflow deployment. Because the flaw is only reachable where the Airflow UI shares a parent domain with other applications, the attacker's reconnaissance focuses on the domain topology: does airflow.example.com share a parent domain (example.com) with other web applications, sibling subdomains, or staging hosts? Deployments on dedicated domains are not viable targets for this chain and should be excluded. The attacker also confirms the version is 3.3.0 or 3.3.1.

2) Triggering the flaw class (session fixation via cookie injection). The attacker must place a valid session cookie of their own into the victim's browser or client. The NVD description enumerates three realistic vectors:

• Cookie tossing from a sibling subdomain — an attacker controlling or influencing another subdomain under the same parent domain sets a cookie scoped to the parent, which the victim's browser then forwards to the Airflow host.
• Cross-site scripting in a separate application sharing a parent domain — an XSS flaw in any co-hosted application can be used to write the attacker's session cookie into the victim's browser under the shared parent domain.
• A shared workstation — an attacker with prior or interleaved physical/session access to a workstation can leave a session cookie in the browser profile.

The attacker's own session cookie bound to their Airflow principal is the artifact being planted.

3) Payload / execution method at the vulnerability-class level. With the attacker's session cookie now present in the victim's browser or client, the victim subsequently makes an API request that includes both the injected session cookie and an explicit Authorization: Bearer token. The intended contract is that the bearer token takes precedence. Under the flaw, Airflow resolves the caller from the cookie instead. The request is executed as the cookie's principal (the attacker's principal), not as the identity the client explicitly presented (the intended bearer principal). No malformed payload is required — the trigger is simply the coexistence of both credentials on a request.

4) Post-exploitation impact. The consequence is principal confusion and misattributed audit records, not direct privilege escalation. Because authorization is evaluated against the cookie's principal, the effective permissions on the affected request are those of the session cookie holder rather than the bearer token holder. Every action taken during that request is written to the audit log against the cookie's principal, contaminating the audit trail. The attacker gains no elevation beyond what the planted session cookie's principal already holds; the value of the attack lies in identity confusion, audit contamination, and the ability to have privileged actions recorded against the wrong actor. Deployments that host the Airflow UI on a dedicated domain with no co-hosted applications are not reachable by this chain.

Impact Assessment

The blast radius is narrow and precisely scoped: Apache Airflow 3.3.0 and 3.3.1 only, and within that, only deployments whose Airflow UI is hosted on a domain shared with other applications. Airflow instances on dedicated domains are not reachable via the documented mechanism.

Business impact centers on integrity of identity and audit data rather than confidentiality of pipeline data or availability. The CVSS vector awards Confidentiality: Low and Integrity: Low, with no Availability impact (C:L/I:L/A:N), which matches the description's framing of the outcome as "principal confusion and misattributed audit records rather than a direct privilege escalation."

Concrete downstream consequences for an enterprise:

• Audit and compliance erosion. Misattributed audit records undermine non-repudiation. Where Airflow audit logs feed SIEM, SOAR, or regulatory evidence pipelines, the affected records are unreliable and may require exclusion or annotation.
• Forensic ambiguity. During incident response, actions logged against a cookie principal may not have originated from the human or service that owns that principal, complicating attribution.
• Permission confusion on shared or automated workflows. Automated API clients that carry a bearer token but also inherit a browser-born cookie may execute under an unintended principal, potentially performing actions the intended token principal should not have performed (or failing to perform actions the token would have been permitted to perform).

The high attack complexity (AC:H) reflects the multi-step precondition — the attacker must first inject a valid cookie into the victim's client — and the user interaction requirement (UI:R) reflects that the victim must subsequently issue a request carrying both credentials. Neither the Confidentiality nor the Integrity impact is rated High because the attacker does not obtain privileges beyond those already held by the planted cookie's principal. There is no CISA KEV listing, no public exploit code, and no Nuclei template at time of writing. EPSS has not yet assigned a score; no EPSS value is fabricated here.

Asset owners should treat this as a hardening and audit-integrity issue rather than an emergency remote code execution class of bug. Priority should be driven by (a) whether the deployment is on a shared parent domain and (b) whether Airflow audit records are relied upon for compliance or incident response.

Detection Guidance

Sigma Rule

title: Apache Airflow Credential Precedence Inversion (Cookie Overrides Bearer)
id: 7c1f9a2e-4b8d-4e51-9a3c-2f8e6d1b0c44
status: experimental
description: Detects requests to the Airflow core API that carry both a session cookie and an Authorization Bearer header, the condition required to trigger CVE-2026-82355 in Airflow 3.3.0-3.3.1.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82355
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1078
  - cve.2026-82355
logsource:
  category: web
  product: apache
detection:
  selection_cookie:
    cs-cookie|contains:
      - 'session='
      - 'airflow_session='
  selection_bearer:
    cs-authorization|startswith: 'Bearer '
  condition: selection_cookie and selection_bearer
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-cookie
  - cs-authorization
falsepositives:
  - Legitimate clients that intentionally send both credentials during migration
  - Proxies or gateways that inject Authorization headers
level: medium

YARA Rule

rule CVE_2026_82355_Airflow_Bearer_Cookie_Coexist
{
    meta:
        description = "Detects log or capture artifacts showing Airflow API requests carrying both a session cookie and a Bearer token, indicative of CVE-2026-82355 exploitation preconditions"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82355"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $bearer = "Authorization: Bearer" ascii nocase
        $auth_lower = "authorization: bearer" ascii nocase
        $cookie_sess = "session=" ascii nocase
        $airflow = "airflow" ascii nocase
        $coreapi = "/api/" ascii nocase

    condition:
        $airflow and ($bearer or $auth_lower) and $cookie_sess
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82355 Apache Airflow Bearer Token and Session Cookie Precedence Inversion Attempt"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Authorization"; nocase; http.header; content:"Bearer "; nocase; http.cookie; content:"session="; nocase; classtype:attempted-user; reference:cve,2026-82355; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82355; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202682355; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and
      http.request.headers contains "Authorization: Bearer" ]
  [ network where http.request.method == "GET" and
      http.request.headers contains "session=" and
      url.path : "/api/*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=airflow
| eval has_bearer=if(match(cs_Authorization, "(?i)Bearer\s+") OR match(Authorization, "(?i)Bearer\s+"), 1, 0)
| eval has_cookie=if(match(cs_Cookie, "(?i)session=") OR match(Cookie, "(?i)session="), 1, 0)
| where has_bearer=1 AND has_cookie=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, cs_uri_stem, cs_Username
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="apache,airflow,cve-2026-82355,">
  <rule id="2026350" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/</field>
    <regex type="pcre2">(?i)Authorization:\s*Bearer\s+</regex>
    <description>CVE-2026-82355: Airflow API request with Bearer token and cookie present - possible credential precedence inversion (3.3.0-3.3.1)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="2026351" level="8">
    <if_sid>2026350</if_sid>
    <regex type="pcre2">(?i)(session=|airflow_session=)</regex>
    <description>CVE-2026-82355: Request carries both session cookie and Bearer token - potential principal confusion and audit misattribution</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor-fixed version is confirmed in tracked sources; no workarounds are published. The NVD description nonetheless states that upgrading to Apache Airflow 3.3.2 or later resolves the caller from the explicitly supplied credential whenever one is present. Treat the upgrade as the intended remediation while validating independently.

1) Immediate mitigations.

• Remove the shared-domain exposure. Host the Airflow UI on a dedicated domain with no co-hosted applications. The NVD description is explicit that a dedicated domain with no co-hosted applications is not reachable via the described mechanism, so domain isolation directly removes the exploitation path.
• Enforce cookie scoping and host-only cookies. Configure the Airflow session cookie with Host-Only and the most restrictive Domain attribute possible, and set Secure and HttpOnly, to reduce the viability of sibling-subdomain cookie tossing.
• Eliminate the coexistence condition. Where feasible, enforce a policy that browser sessions do not carry bearer tokens and that API clients do not carry session cookies. Reject or strip requests that present both credentials at the reverse proxy or API gateway.
• Audit log review. Treat Airflow audit records generated on 3.3.0/3.3.1 during any period of suspected exposure as potentially misattributed and flag them for secondary verification against upstream authenticating systems.
• Reduce co-hosted application risk. Because XSS in any application sharing the parent domain is a documented injection vector, prioritize XSS remediation and CSP hardening across sibling applications under the same parent domain.

2) Patch / upgrade steps.

• Identify all Airflow deployments and confirm the running version. Only 3.3.0 and 3.3.1 are affected; earlier releases do not contain the vulnerable cookie-caching path.
• Upgrade affected instances to Apache Airflow 3.3.2 or later, which resolves the caller from the explicitly supplied credential whenever one is present.
• After upgrading, validate that a request carrying both a session cookie and an Authorization: Bearer token is executed and logged under the bearer token's principal.
• Because patch confidence is 0/4 and no registry of fixed versions has been independently confirmed, verify the fix against the official Apache Airflow release notes before closing the finding.

3) Long-term hardening.

• Adopt a single-credential policy per request type at the gateway layer: API clients use bearer tokens only; browsers use cookies only. Reject mixed-credential requests by default.
• Enforce strict domain isolation for administrative and orchestration tooling; avoid hosting automation control planes under parent domains shared with user-facing or frequently changing applications.
• Implement content security policy, subresource integrity, and continuous XSS testing across all applications sharing a parent domain.
• Add detection coverage (rules above) so that any future reintroduction of mixed-credential requests is surfaced immediately.
• Include credential precedence and identity-resolution assertions in pre-deployment test suites for authentication-critical services.
• Maintain an inventory of Airflow audit log consumers so that integrity concerns can be triaged quickly if similar issues recur.

References

• NVD — CVE-2026-82355: https://nvd.nist.gov/vuln/detail/CVE-2026-82355
• Apache Airflow official security page (vendor advisories): https://airflow.apache.org/docs/apache-airflow/stable/security/index.html
• Apache Airflow 3.3.2 release notes and changelog (verification of fix): https://airflow.apache.org/
• CWE-384 — Session Fixation: https://cwe.mitre.org/data/definitions/384.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/

Threat actor campaigns and exploit-in-the-wild evidence: none identified. CVE-2026-82355 is not listed in CISA KEV, has no public PoC or exploit code, and has no Nuclei template. EPSS has not assigned a score at time of writing.