Skip to main content

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2026-40961

High
7.2/10

Summary

Apache Airflow contains an Open Redirect vulnerability in the login redirect route. The application allows authenticated users to craft URLs that bypass the "is_safe_url" check, enabling redirection from a trusted Airflow domain to an attacker-controlled domain. Users should upgrade to "apache-airflow" version 3.2.2rc1 or later to remediate the issue. As a defense-in-depth measure, deployment operators may place Airflow behind a reverse proxy that removes off-domain "next=" query parameters before they reach the login endpoint.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-601 - Open Redirect

An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.

References

Advisory Timeline

  • Published