A session management vulnerability in Apache Airflow allows unauthenticated attackers to perform full session takeover via cross-application cookie capture.

The vulnerability exists because the session token is set to path=/ regardless of the configured base URL, which constitutes an exposure of resources to the wrong sphere (CWE-668). This flaw allows any application co-hosted under the same domain to capture valid session tokens from HTTP request headers, requiring no authentication by the attacker to initiate the theft.

Successful exploitation allows an attacker to gain full control over an Airflow session, leading to unauthorized access to sensitive data and pipeline configurations. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to organizational data integrity and operational security. If Airflow is used to manage critical infrastructure, this session takeover could result in the compromise of downstream systems and significant reputational damage.

Immediate Action: Upgrade to Apache Airflow 3.1.8 or later, which correctly restricts session cookie scoping.

Proactive Monitoring: Review web server access logs for anomalous requests or unauthorized session activity originating from co-hosted applications on the same domain.

Compensating Controls: Implement strict domain isolation for all co-hosted applications and utilize browser-based security headers to limit cookie visibility until the patch can be applied.

Public Exploit Available: Unknown.

The risk posed by CVE-2026-28779 is substantial due to the ease with which session tokens can be intercepted in shared-domain environments. IT administrators should prioritize the deployment of Airflow 3.1.8 immediately to address this session management flaw and protect against potential unauthorized access.