Threats affecting pkg:maven/org.apache.airflow/airflow-core

Apache Airflow versions 3.3.0 and 3.3.1 contain a session fixation vulnerability where the system prioritizes a session cookie over an explicit Authorization Bearer token. This causes the API to authenticate the user based on the cookie rather than the token, leading to principal confusion and inaccurate audit logs. Exploitation requires an attacker to place a valid session cookie in the victim's browser, which is more feasible in environments sharing domains with other applications. The issue is fixed in version 3.3.2.