{"id":"CVE-2026-40961","aliases":["GHSA-6hcw-qqr8-pjj8","BIT-airflow-2026-40961"],"title":"Apache Airflow: Authenticated users can bypass the `is_safe_url` check","summary":"Apache Airflow: Authenticated users can bypass the `is_safe_url` check","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","vendor":"apache-airflow","product":"apache-airflow","ecosystem":"pip","affected":["apache-airflow < 3.2.2"],"patched":["apache-airflow 3.2.2"],"published":"2026-06-01","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6hcw-qqr8-pjj8","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40961"},{"url":"https://github.com/apache/airflow/pull/65557"},{"url":"https://github.com/apache/airflow"},{"url":"https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/31/2"}],"tags":["osv","pip"],"epss":0.00759,"epssPercentile":0.53366,"ingestedAt":"2026-07-08T18:25:46.477Z","slug":"CVE-2026-40961","body":"## Overview\n\nA bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain `next=` query parameters before they reach the login endpoint.\n\n## Affected packages\n\n- `apache-airflow < 3.2.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-airflow 3.2.2`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}