The vulnerability in Apache Airflow 3.0.0 involves the JWTRefreshMiddleware setting the JWT auth cookie without the Secure flag. In typical cloud-native deployments where TLS termination occurs at a reverse proxy (e.g., nginx, Envoy, or managed load balancers) and the API server receives unencrypted HTTP traffic, the JWT cookie can be transmitted over cleartext HTTP. This allows a network attacker capable of intercepting HTTP traffic (such as a Wi-Fi MITM or hostile LAN) to capture the JWT cookie and replay it to gain unauthorized API access. The issue affects session integrity when the Secure flag is relied upon to protect the cookie during HTTPS sessions. The vendor recommends upgrading to Apache Airflow 3.2.2 or later to mitigate this vulnerability.

An attacker with network access can capture the JWT authentication cookie if a logged-in user's browser sends an HTTP request to the Airflow API server's hostname. This allows the attacker to replay the JWT cookie and potentially access the API with the user's privileges. The vulnerability compromises confidentiality of the JWT token but does not affect integrity or availability directly. The CVSS score is 5.9 (medium severity), reflecting the network attack vector with high complexity and no user interaction required.

Users should upgrade Apache Airflow to version 3.2.2 or later, where this issue is fixed by setting the Secure attribute on the JWT authentication cookie. Until upgrade, ensure that all traffic to the Airflow API server is strictly HTTPS and that no HTTP requests can be made to the same hostname to prevent cookie leakage. Patch status is not explicitly stated in the vendor advisory, but the recommendation to upgrade to 3.2.2 or later indicates an official fix is available in those versions.