CVE-2026-82355 is a session fixation vulnerability in Apache Airflow 3.3.0 and 3.3.1. When a request includes both a session cookie and an Authorization Bearer token, Airflow incorrectly resolves the caller identity from the session cookie, ignoring the bearer token. This inversion of intended precedence causes the request to be executed and audit-logged as the cookie's principal rather than the explicitly presented bearer token identity. Exploitation requires an attacker to place a valid session cookie in the victim's client, achievable through cookie tossing from sibling subdomains, cross-site scripting in co-hosted applications, or shared workstations. Deployments on dedicated domains without co-hosted applications are not vulnerable to this attack vector. The vulnerability leads to principal confusion and misattributed audit logs but does not directly escalate privileges. The issue is fixed in Apache Airflow 3.3.2 and later, which correctly prioritizes explicit credentials over session cookies.

The vulnerability causes principal confusion and misattribution in audit logs by executing requests under the identity associated with a session cookie rather than the explicitly supplied bearer token. This can lead to inaccurate audit trails and potential confusion in user accountability. There is no direct privilege escalation or unauthorized access beyond this misattribution. Deployments sharing domains with other applications are at higher risk due to easier attacker access to valid session cookies.

Users running Apache Airflow versions 3.3.0 or 3.3.1 should upgrade to version 3.3.2 or later, where the vulnerability is fixed by ensuring the caller is resolved from the explicitly supplied credential when present. Deployments should also consider hosting Airflow on a dedicated domain without co-hosted applications to reduce exposure to cookie tossing or cross-site scripting attacks. Patch status is confirmed by the vendor advisory indicating the fix is in 3.3.2.