CVE-2026-40961: Apache Airflow: Open Redirect Bypass Vulnerability

Synopsis

An open redirect vulnerability in Apache Airflow's login redirect route allows an unauthenticated remote attacker to craft a URL that bypasses the built-in safe-URL check, causing victims who click the link to be silently forwarded from a trusted Airflow domain to an attacker-controlled site. No authentication is required and no special conditions need to be met, making this straightforward to weaponize for phishing and credential-harvesting campaigns. A patched-image rebuild at version 3.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Airflow login endpoint over the network; the service must be exposed to the attacker's network path.

• AuthenticationNot required

  No account or session credentials are needed to craft and distribute the malicious redirect URL.

• Victim interactionRequired

  A victim must click the attacker-crafted URL for the redirect to occur, making this a social-engineering vector typically delivered via phishing.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental state are required to craft a bypassing URL.

Blast Radius

• A victim who clicks the crafted link is redirected from the trusted Airflow domain to an attacker-controlled site without visible warning.
• The attacker can present a spoofed Airflow login page at the destination, harvesting the victim's Airflow credentials or SSO tokens.
• Session cookies or authentication tokens passed in the redirect chain may be exposed to the attacker-controlled origin depending on browser and proxy behavior.