CVE-2026-40961: Apache Airflow Open Redirect Vulnerability (CVSS 7.2)

Technical summary

CVE-2026-40961 is an open redirect vulnerability (CWE-601) in Apache Airflow's login redirect route. The `is_safe_url` validation function fails to properly sanitize certain URL patterns, permitting authenticated users to inject arbitrary `next=` query parameters that bypass the intended whitelist. This allows redirection from the trusted Airflow domain to attacker-controlled origins. The vulnerability requires authentication but not elevated privileges, and the attack surface is network-accessible with no special client-side complexity.

Business impact

Open redirect vulnerabilities in authentication flows pose significant phishing and credential theft risks. An attacker can trick users into following a legitimate-looking Airflow login URL that redirects to a spoofed login page after authentication, capturing credentials or session tokens. This is particularly dangerous in enterprise environments where Airflow manages critical data pipeline orchestration. Reputational damage and compliance exposure (depending on what data Airflow processes) may also result.

Affected systems

Apache Airflow versions prior to 3.2.2 are vulnerable. Any deployment running an earlier version and exposing the login endpoint to a network (internal or external) is at risk. The vulnerability requires authentication, so it does not affect configurations with disabled authentication or private networks with no user access.

Exploitability

Exploitation requires an authenticated user and the ability to craft a malicious URL pointing a victim to the login page with a booby-trapped `next=` parameter. The attack is not complex but does rely on social engineering to trick a user into clicking the link. No known public exploits or active in-the-wild attacks have been reported at publication time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Apache Airflow to version 3.2.2 or later, which includes a corrected URL validation routine. As a defense-in-depth layer, operators can deploy Airflow behind a reverse proxy (nginx, Apache httpd, or cloud-native equivalents) configured to strip or validate `next=` query parameters before requests reach the login endpoint, reducing exposure even on older versions during transition periods.

Patch guidance

Apply Apache Airflow 3.2.2 or later as soon as feasible within your change management process. Test the upgrade in a staging environment first to ensure compatibility with custom authentication backends, plugins, or reverse proxy configurations. Verify that the login redirect behavior functions correctly after patching by testing authentication flows with various return URLs. If immediate patching is not possible, implement the reverse proxy mitigation to reduce risk.

Detection guidance

Monitor login endpoint access logs for suspicious `next=` parameters containing off-domain or obfuscated URLs (URL encoding, protocol confusion, etc.). Look for patterns such as `next=http://`, `next=//`, or other protocol indicators that deviate from your expected internal redirect domains. Implement rate-limiting on login attempts to slow credential enumeration or phishing attacks. Review authentication logs for successful logins followed by immediate redirects to external domains, which may indicate attack attempts.

Why prioritize this

A CVSS score of 7.2 (HIGH) reflects the network accessibility, low attack complexity, and potential for scope change (redirecting users to external sites). While authentication is required, the barrier is typically low in internal networks, and the impact—credential theft and phishing—directly threatens user security and application integrity. The lack of public exploits and KEV status provides some breathing room, but this should not delay patching timelines beyond standard critical update cycles.

Risk score, explained

The score of 7.2 is driven by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. Network accessibility (AV:N), low attack complexity (AC:L), and no privilege requirement (PR:N) elevate severity; the UI:N rating acknowledges that authenticated users can execute the attack autonomously. Scope change (S:C) reflects that the redirect affects systems outside Airflow itself (the victim's browser and attacker's domain). Confidentiality and integrity impacts are limited (C:L/I:L) because the redirect itself does not exfiltrate data or modify Airflow state, but it enables downstream attacks like credential theft.

Frequently asked questions