Threats tagged 'ghsa-9x6g-jfj6-r3jg'

Apache Airflow versions 3.3.0 and 3.3.1 contain a vulnerability where requests to the core API that include both a session cookie and an Authorization: Bearer token incorrectly prioritize the session cookie over the bearer token. This leads to the request being executed and logged as the cookie's user rather than the explicitly presented bearer token user. Exploitation requires an attacker to place a valid session cookie in the victim's client, such as via cookie tossing or cross-site scripting in co-hosted domains. The issue causes principal confusion and misattributed audit logs but does not directly escalate privileges. Upgrading to Airflow 3.3.2 or later resolves this issue.